← Feed

Posts

• View post

  Anchore is now an OpenChain Partner in the Vendor category. OpenChain, hosted by the Linux Foundation, maintains ISO/IEC 5230 (license compliance programs) and ISO/IEC 18974 (open source security assurance). Both come back to one question: what's actually in your software? https://anchore.com/blog/anchore-is-now-an-openchain-partner/ #OpenChain #OpenSource #SBOM #SupplyChainSecurity

• View post

  ISO 27001:2022 transition deadline: October 31, 2025. Already passed. Certs still on the 2013 version aren't valid. Here's what Annex A 5.9 and 8.8 actually require, and how 1 SBOM covers both: https://anchore.com/blog/one-sbom-five-auditors/

• View post

  "The format doesn't really matter... It's really about the content." We hosted @stevespringett, Chair of the CycloneDX WG, to discuss why the industry needs to stop fighting format wars and start focusing on data utility. Read the 4 lessons: https://anchore.com/blog/4-lessons-on-future-of-software-transparency-with-steve-springett/

• View post

  Same Log4Shell, bigger blast radius in a developing country. World Bank Findex 2021: 71% of adults in developing economies have a financial account; 33% in Sub-Saharan Africa have mobile money. When a few providers carry that load, a compromised one may have no failover. An SBOM tells you where the vulnerable component lives. https://anchore.com/blog/how-sbom-management-empowers-developing-nations/ #SBOM #Log4Shell #InfoSec #CyberResilience

• View post

  Mitigate vulnerability noise. EU CRA incident reporting starts in 2026. You can't report what you cannot see. Stop manual triage & deploy continuous monitoring to accelerate remediation. Enforce policy gates to stay compliant by default & ship secure software faster. https://anchore.com/blog/eu-cra-vulnerability-management/

• View post

  STIG scanning tools historically struggle with distroless images because they require an in-container shell. That gap is closed. Anchore Enterprise now evaluates STIG controls on shell-less @chainguard_dev images directly at the image layer. https://anchore.com/blog/stig-compliance-chainguard-images-now-supported/

• View post

  If a vulnerable water, power, or telecom system has no failover, taking it offline to patch is its own outage. SBOM data lets a small team find every system with a vulnerable Log4j version, rank them by criticality, and apply targeted mitigations where patching has to wait. Visibility, mostly. https://anchore.com/blog/how-sbom-management-empowers-developing-nations/ #SBOM #Log4Shell #CriticalInfrastructure #InfoSec

• View post

  DoW Instruction 8430.01 took effect September 8, 2026. SBOMs for all covered software, including transitive dependencies (§3.5.b), plus machine-readable build provenance and security evidence, are now a condition to operate on DoW networks (§3.5.a(1)). We went through the instruction paragraph by paragraph: https://anchore.com/blog/dow-instruction-8430-01-makes-software-evidence-a-condition-to-operate/ #SBOM #SoftwareSupplyChain #DevSecOps #OpenSource

• View post

  An open-weight AI model isn't software. It's weights that software runs, which is why most SBOM and SCA tooling never sees the models your teams pull from Hugging Face or ModelScope. Live webinar Oct 20, 10am PT / 1pm ET: Dan Nurmi and Christopher Phillips on what open-weight models are and why existing asset management tools fall short. Register: https://go.anchore.com/managing-security-risks-for-os-ai.html #ShadowAI #SBOM #AISecurity

• View post

  Open-weight AI models pulled from Hugging Face or ModelScope won't show up in a standard SBOM. Catching them means detecting models during the build and surfacing their identifiers and metadata before production. Live webinar Oct 20, 10am PT / 1pm ET to show you how. Register: https://go.anchore.com/managing-security-risks-for-os-ai.html #ShadowAI #SBOM #AISecurity

• View post

  @joshbressers: "If you can't search your past builds, you can't bound your blast radius. SBOMs turn a frantic morning into a simple query." His zero-day incident response story from inside Anchore's response to the NPM supply chain attack: https://anchore.com/blog/a-zero-day-incident-response-story-from-the-watchers-on-the-wall/

• View post

  If you ship open source to DoW: DoWI 8430.01 (effective September 8, 2026) requires SBOMs for all covered software, including transitive dependencies (§3.5.b), and a risk review of third-party and open source components (§3.5.i(2)). On our side, Anchore Enterprise generates SBOMs at every build and imports vendor SBOMs. Here's the mapping: https://anchore.com/blog/dow-instruction-8430-01-makes-software-evidence-a-condition-to-operate/ #SBOM #OpenSource #SoftwareSupplyChain

• View post

  EO 14306 removed CISA's central role in validating SSDF attestations. Vendors now hold their own audit-ready proof. What that means for your next federal RFP: https://anchore.com/blog/one-sbom-five-auditors/

• View post

  🚀 New hardened container companies are launching constantly. The reason isn't compliance mandates—it's practical necessity. When scanners got accurate, the vulnerability problem became impossible to ignore. Hardened images are the efficient solution. https://anchore.com/blog/hardened-images-are-here-to-stay/

• View post

  MCP is having a moment. @josh.bressers.name wanted to know: what are we actually shipping? 9,000 vulns 263 critical findings 36K+ NPM packages Outdated base images Not fear-mongering—just data-driven reality. Read his analysis: https://anchore.com/blog/analyzing-the-top-mcp-docker-containers/ #MCP #ContainerSecurity

• View post

  Built on 30M+ download open source tools (Syft & Grype) 🔧 Community-proven, enterprise-hardened 💪 https://anchore.com/platform/secure/ #SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps

• View post

  Supply chain attacks ↗️ 742% in 2023 Your traditional security stack wasn't built for this fight. SBOM-first architecture changes everything ⚡ https://anchore.com/platform/ #SoftwareSupplyChain #SBOM #CyberSecurity

• View post

  Manual SBOM generation requires combing through package.json or go.mod files for every code commit. This doesn't scale. Automated generation replaces this with a single CLI command. Our new eBook, SBOM 102, covers how to embed CLI binaries directly into your DevSecOps pipeline so a new inventory is built with every commit. Read the eBook: https://go.anchore.com/sbom102-guide-to-automated-sboms.html

• View post

  You already run an SBOM pipeline and a policy-as-code workflow. Your open-weight AI model inventory shouldn't need a separate process. Tomorrow, Oct 20, 10am PT / 1pm ET: Dan Nurmi and Christopher Phillips on extending your existing workflow to cover AI models, plus how to evaluate them for jailbreaks, prompt injection, and data exfiltration. Last chance to register for the webinar: https://go.anchore.com/managing-security-risks-for-os-ai.html #ShadowAI #SBOM #PolicyAsCode

• View post

  DoW Instruction 8430.01 took effect September 8, 2026 and makes machine-readable software evidence a condition to operate on DoW networks. Suppliers have disclosure duties too: critical or actively exploited vulnerabilities must be reported within a timeframe the DoW CIO sets (§3.5.h(2)). If you supply software to DoW, vulnerability disclosure is now part of the deal. https://anchore.com/blog/dow-instruction-8430-01-makes-software-evidence-a-condition-to-operate/ #SoftwareSupplyChain #SBOM

• View post

  Scale-out architecture for web-scale environments 📈 Because your containers don't wait for security scans ⏱️ https://anchore.com/platform/secure/ #SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps

• View post

  FedRAMP compliance in weeks, not months ⚡ Ready-to-deploy policy packs for instant compliance feedback 📋 https://anchore.com/platform/enforce/ #SoftwareSupplyChain #SBOM #CyberSecurity #Compliance

• View post

  Tomorrow: Anchore + Chainguard demo STIG checks running on shell-less container images, live, no shell execution required. 10am PT / 1pm ET. Sign up: https://go.anchore.com/running-STIG-with-Chainguard #STIG #Chainguard

• View post

  "The format doesn't really matter... It's really about the content." We hosted @stevespringett, Chair of the CycloneDX WG, to discuss why the industry needs to stop fighting format wars and start focusing on data utility. Read the 4 lessons: https://anchore.com/blog/4-lessons-on-future-of-software-transparency-with-steve-springett/

• View post

  Built on 30M+ download open source tools (Syft & Grype) 🔧 Community-proven, enterprise-hardened 💪 https://anchore.com/platform/secure/ #SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps

• View post

  ⚠️ Root user running ⚠️ Secrets in plain text ⚠️ Missing SBOM Each one maps to a specific NIST 800-171 control your CMMC audit will check. The Anchore Enterprise CMMC Policy Pack automates all of it. https://anchore.com/blog/how-to-automate-cmmc-compliance-for-containers-sboms/

• View post

  Your MCP server might be the weakest link—here's the data. @josh.bressers.name scanned 161 MCP images and found 9,000 vulns / 263 criticals. Read the breakdown and fixes: https://anchore.com/blog/analyzing-the-top-mcp-docker-containers/ #MCP #SoftwareSupplyChain #ContainerSecurity #DevSecOps

• View post

  CMMC 2.0 Phase 2 starts Nov 10, 2026. Level 2 contractors face mandatory C3PAO audits. FedRAMP cloud alone won't cover you, container images and SBOMs still need proof. How we automate NIST 800-171 mapping: https://anchore.com/blog/how-to-automate-cmmc-compliance-for-containers-sboms/

• View post

  🚀 New hardened container companies are launching constantly. The reason isn't compliance mandates—it's practical necessity. When scanners got accurate, the vulnerability problem became impossible to ignore. Hardened images are the efficient solution. https://anchore.com/blog/hardened-images-are-here-to-stay/

• View post

  Built on 30M+ download open source tools (Syft & Grype) 🔧 Community-proven, enterprise-hardened 💪 https://anchore.com/platform/secure/ #SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps