SBOM

SUSE Bets on Open Infrastructure as the AI Workload Platform

SUSE Bets on Open Infrastructure as the AI Workload Platform

Application Development, DevSecOps, Events, Infrastructure, KubeCon + CloudNativeCon NA 2026 /

SUSE announced coordinated updates to Rancher Prime, AI Factory, and SLES 16.1, adding agentic AI management, unified OS lifecycle support, and a verified AI software supply chain. The release targets enterprises moving from AI experimentation to production deployment across hybrid environments. ECI Research data highlights why developer velocity and lock-in anxiety make this a well-timed platform play.

SUSE Bets on Open Infrastructure as the AI Workload Platform Read More »

OpenSSF Expands AI Security Resources for Open Source | ECI Research

OpenSSF Expands AI Security Resources for Open Source | ECI Research

AI, Application Development, DevSecOps, Events, KubeCon + CloudNativeCon NA 2026 /

OpenSSF announced new members, a developer guide to AI-assisted vulnerability management, a new SAIA certification, and expanded malicious package coverage across eight ecosystems. The moves address a structural gap between AI-accelerated code production and security teams’ ability to keep pace. ECI Research analysis explains what it means for government and enterprise ITDMs and developers.

OpenSSF Expands AI Security Resources for Open Source | ECI Research Read More »

Chainguard Athena: Fixing AI-Accelerated Vulnerabilities at Scale

Chainguard Athena: Fixing AI-Accelerated Vulnerabilities at Scale

Application Development, DevSecOps, Open Source, Supply Chain /

Chainguard has launched Athena, an industry coalition designed to close the gap between AI-accelerated vulnerability discovery and actual remediation. With 1 billion container build manifests processed, Chainguard has the scale to back its ambitions. ECI Research data reveals why inconsistent SBOM practices and compliance friction make this problem harder than it looks.

Chainguard Athena: Fixing AI-Accelerated Vulnerabilities at Scale Read More »

Cloudsmith's Confidence Gap: Supply Chain Security's Blind Spot

Cloudsmith’s Confidence Gap: Supply Chain Security’s Blind Spot

Application Development, Application Security, DevSecOps /

Cloudsmith’s Confidence Gap Report exposes a critical disconnect: most engineering teams believe their tooling stops install-time attacks, but fewer than half scan dependencies before they enter their environment. The gap between perceived and actual supply chain security is the vulnerability. This note examines what it means for developers, ITDMs, and regulated-sector organizations.

Cloudsmith’s Confidence Gap: Supply Chain Security’s Blind Spot Read More »

RapidFort & SpaceWERX Target AI Software Supply Chain Security

RapidFort & SpaceWERX Target AI Software Supply Chain Security

Application Development, Cyber Security, Government Technology /

RapidFort and SpaceWERX held a national security-focused conference to address AI software supply chain vulnerabilities, agentic system risks, and post-quantum cryptography readiness. The event, grounded in a formal CRADA, signals a shift from policy discussion to operational implementation. ECI Research data shows FedRAMP compliance friction and inconsistent SBOM practices remain the biggest structural barriers to progress.

RapidFort & SpaceWERX Target AI Software Supply Chain Security Read More »

CRA Compliance, AI Security, and Open Source Sovereignty | ECI Research

CRA Compliance, AI Security, and Open Source Sovereignty | ECI Research

AI, Application Development, Compliance, Cyber Security, Events, Open Source, Open Source Summit Europe 2026 /

OpenSSF leadership and Linux Foundation policy panelists at Open Source Summit Europe 2026 converged on three urgent themes: CRA compliance readiness is dangerously low, AI-assisted development is outpacing security governance, and Europe’s open source sovereignty gap is a services problem, not a software problem. ECI Research overlays survey data to show what this means for ITDMs and developers navigating regulated environments.

CRA Compliance, AI Security, and Open Source Sovereignty | ECI Research Read More »

OpenSSF, AWS, and the New Stakes of Open Source Security Compliance

OpenSSF, AWS, and the New Stakes of Open Source Security Compliance

Application Development, Compliance, Cyber Security, Events, Infrastructure, Open Source, Open Source Summit Europe 2026 /

OpenSSF announced four new members and a suite of EU Cyber Resilience Act readiness resources at Community Day Europe, while AWS elevated to Platinum membership at the Linux Foundation. Together, the moves signal enterprise consolidation around open source security governance as CRA enforcement begins and AI accelerates vulnerability discovery. ECI Research data shows significant gaps between compliance mandates and operational readiness that these initiatives directly address.

OpenSSF, AWS, and the New Stakes of Open Source Security Compliance Read More »

RapidFort and Trivy Cut CVE Noise in Software Supply Chain Security

RapidFort and Trivy Cut CVE Noise in Software Supply Chain Security

Compliance, Cyber Security /

RapidFort and Aqua Security have partnered to integrate RapidFort’s remediation advisories into the Trivy open-source scanner, enabling accurate reporting of near-zero CVE container images. The integration reduces scanner noise and false positives without requiring developers to own the remediation work themselves. For security and engineering teams, it means scan results that actually reflect reality at the build gate.

RapidFort and Trivy Cut CVE Noise in Software Supply Chain Security Read More »

AI Is Breaking Open Source Trust — And Provenance Is the Fix

AI Is Breaking Open Source Trust — And Provenance Is the Fix

AI, Application Development, Open Source /

AI-accelerated development is flooding open source maintainers with unreviewed pull requests while cryptographic signing and SBOM adoption remain dangerously low. Timothy Lewis of tea.inc. argues that provenance and identity are the missing foundations of enterprise software supply chain security. ECI Research data shows that AI-generated package risk is now the top open-source security concern for 2026.

AI Is Breaking Open Source Trust — And Provenance Is the Fix Read More »

RapidFort + CrowdStrike: Closing the Container Vulnerability Gap

RapidFort + CrowdStrike: Closing the Container Vulnerability Gap

Application Development, Cloud, Cyber Security, DevSecOps /

RapidFort’s new integration with CrowdStrike Falcon Cloud Security targets the gap between vulnerability detection and remediation in Kubernetes environments. By ingesting SBOM and CVE data from Falcon and automating container image hardening, the two vendors aim to close a loop that has historically required significant manual intervention. The integration has particular relevance for federal and defense organizations operating in air-gapped environments.

RapidFort + CrowdStrike: Closing the Container Vulnerability Gap Read More »