Cloudsmith, the leading cloud-native artifact management and software supply chain platform, today announced an expansion to its policy management and continuous risk detection capabilities, adding policy templates, cooldown policies, and expanded evaluation triggers.
The new features continue to strengthen the artifact repository as the most critical point of control for securing the software supply chain and providing proactive protection for developers.
Select customers have been testing the new features and reporting significant benefits, especially from new cooldown and malicious package policies. Attacks increasingly target pipelines and open source packages, so one misconfigured pipeline can result in an incident. Since Cloudsmith policies apply company-wide at the repository level, the risk of a misconfigured pipeline is greatly reduced.
Christian Jensen, VP of Engineering at Tricentis, said, “Cloudsmith is one way in which we identify vulnerabilities and manage artifacts across teams and products we support. It allows us to secure our supply chain by enforcing policies at the registry, which lets us stop malicious packages before they ever reach a developer or a pipeline, and gives us clear and consistent visibility into high and critical vulnerabilities within those packages across the organization.”
Cloudsmith reduces time to policy enforcement, minimizes friction for developers, and ensures policy changes take effect immediately across repositories. New features being announced today include:
- Policy templates: pre-configured policies as code, written in the Rego language, to jump-start a set of recommended baseline controls to begin enforcement immediately.
- Cooldown policies: Highly configurable cooldown policies that apply across repositories, teams, and formats. Cloudsmith cooldown policies work by creating a filtered view of upstream public registry package indexes, so that each developer or CI/CD pipeline’s package managers see only versions that meet policy and thus default to the latest compliant version automatically. This prevents build failures and eliminates the need to revise dependency files.
- Expanded evaluation triggers: In addition to evaluating on package upload and when threat intelligence updates, Cloudsmith policies now also evaluate when a policy is created or updated, without the need for a manual backfill step.
Together, these capabilities strengthen Cloudsmith’s role as a comprehensive, centrally-managed control plane for the software supply chain.
Alison Sickelka, Cloudsmith’s VP of Product, said “We built policy management and continuous risk detection because we believe the artifact management layer is the right place to enforce control over the software supply chain. Security teams are recognizing that centralizing these workflows enhances security, and it shows: this is some of the fastest adoption we’ve seen from customers, from cooldown policies to our risk detection capabilities. As AI reshapes both sides of the equation, how software gets built, and how it’s used as an attack vector, teams need a strong boundary to stop unsafe software at the source and continuous insight and control of the software they already use. Today’s update delivers that across every team, every pipeline, and every package format.”
To learn more, visit our software supply chain security page.
To learn more, visit: https://cloudsmith.com/
Be First to Comment