Finite State raises $27 million for connected-device security
The Series C, led by The O.H.I.O. Fund, will fund international growth and more automation in firmware analysis.
Stories per day · 30 days
6 RSS
Relatedsupply-chain3vex3devsecops2software-supply-chain2vulnerability-management2ai-bom1brotli1connected-devices1container-security1cyclonedx1devguard1disclosure1embargo1finite-state1firmware1funding1grype1image-scanning1
35 stories, newest first · one card per story
Stories tagged #sbom
Friedman says SBOMs matter for response, not static inventories
He argues accurate supplier SBOMs speed Log4j-style response, while VEX separates vulnerable components from exploitable ones.
Blog argues rapid disclosures leave defenders unable to keep up
A week of KVM, PHP, CA, and Brotli issues shows fixes arrive faster than inventory, assessment, and rollout.
1
SBOMs missed scope of a Shai-Hulud supply-chain compromise
A stale SBOM called a SaaS environment clean while a hidden transitive dependency had already run.
1
DevGuard open-source platform ranks and tracks supply-chain findings
One CLI wraps six scan types, and a registry proxy can block known-malicious npm, Go, and Python packages before download.
12 Best SBOM Tools Compared (2026): Features & Pricing
A 2026 roundup ranks 12 SBOM tools, naming Anchore Syft the best free generator and FOSSA and Cybeats top managers.
6
10 Best Container Image Scanning Tools Compared (2026): Features & Pricing
A 2026 roundup compares ten container image scanners, from free Trivy and Grype to Sysdig, Wiz, and Chainguard.
6
The Unreasonable Effectiveness of Vex in NixOS
Blog post argues NixOS can automate VEX statements so teams skip unreachable CVE findings.
Top 10 Best Container Image Scanning Tools in 2026 [Ranked & Scored]
A 2026 ranking puts Trivy, Sysdig, and Wiz atop container image scanners, favoring context over raw CVE counts.
6
12 Best Software Supply Chain Security Tools Compared (2026): Features & Pricing
A 2026 buyer's guide compares 12 software supply-chain security tools by attack surface, features, and pricing.
10
Insignary Launches Clarity AIR to Detect Undeclared Open-Source and AI-Written Code
Insignary released Clarity AIR to find undeclared open-source snippets and AI-written code missing from SBOMs.
2
Top 10 Best Software Supply Chain Security Tools in 2026 [Ranked & Scored]
A 2026 supply-chain security ranking names Chainguard first, then Sonatype and Snyk.
3
Top 10 Best SCA Tools in 2026 [Ranked & Scored]
A 2026 ranking of ten SCA tools places Snyk first, then Sonatype and Endor Labs.
9
Red Hat’s Lightwell Project Remediates 400 Open-Source Vulnerabilities
Red Hat’s Lightwell clearinghouse has patched over 400 Java open-source flaws and reached general availability.
Your enterprise doesn’t need six BOM programs. It needs one evidence graph
A CSO essay argues enterprises should replace separate BOM programs with one federated evidence graph.
EU Cyber Resilience Act ‘completely kills’ manual vulnerability triage
Experts say the EU Cyber Resilience Act’s 24-hour reporting clock makes manual vulnerability triage impractical.
3
10 Best Container Registry Security Tools Compared (2026): Features & Pricing
A 2026 roundup compares 10 container registry security tools, led by free Harbor and Trivy.
4
How Financial Services Companies Can Modernize Their Software Supply Chain
Chainguard argues banks should harden images and libraries instead of full application rewrites.
1
EU Cyber Resilience Act requirements for containers and Kubernetes
The EU Cyber Resilience Act imposes SBOM, patching, and 24-hour exploit reporting duties on container and Kubernetes products.
1
Resource-Optimized and Energy-Aware Agentic AI Framework Anchored on Blockchain for Secure Software Supply Chains
Researchers propose a blockchain-anchored agentic AI framework that attests SDLC security checks before release.
.webp&w=828&q=75)
Top 10 Best Container Registry Security Tools in 2026
A 2026 buyer's guide scores ten container registry security tools including Aqua, Snyk, JFrog Xray, Prisma Cloud, and Anchore.
6
TrustBOM: A Scalable Architecture for Confidentiality-Preserving SBOMs Across Organizations
TrustBOM lets vendors prove SBOMs lack specified vulnerabilities or licenses without revealing dependencies.
Mind the Gap: How SBOM Specification Ambiguities Lead to Divergent Software Bills of Materials. An Empirical Tool Study
Empirical study of three SBOM generators across 3,000+ JavaScript and Rust projects finds systematic divergences caused by specification ambiguities, risking CRA non-compliance.
AI is adding to the review load on open-source projects, many of them thinly funded
ACM Technology Policy Council authors warn AI-generated code is overwhelming thinly funded open-source maintainers, raising software supply chain security risks.
3