software supply chain

SUSE Bets on Open Infrastructure as the AI Workload Platform

SUSE Bets on Open Infrastructure as the AI Workload Platform

Application Development, DevSecOps, Events, Infrastructure, KubeCon + CloudNativeCon NA 2026 /

SUSE announced coordinated updates to Rancher Prime, AI Factory, and SLES 16.1, adding agentic AI management, unified OS lifecycle support, and a verified AI software supply chain. The release targets enterprises moving from AI experimentation to production deployment across hybrid environments. ECI Research data highlights why developer velocity and lock-in anxiety make this a well-timed platform play.

SUSE Bets on Open Infrastructure as the AI Workload Platform Read More »

Cloudsmith Launches AI Agent Skills Registry at KubeCon 2026

Cloudsmith Launches AI Agent Skills Registry at KubeCon 2026

Application Development, DevSecOps, Events, KubeCon + CloudNativeCon NA 2026, Platform Engineering /

Cloudsmith announced its AI Agent Skills Registry at KubeCon 2026, extending enterprise artifact governance to the AI coding agent skills that autonomous agents execute during software development. The move addresses a growing software supply chain gap as agentic workflows expand beyond traditional developer populations. Platform engineering teams gain version control, policy enforcement, and audit observability for AI skills alongside existing artifact types.

Cloudsmith Launches AI Agent Skills Registry at KubeCon 2026 Read More »

OpenSSF Expands AI Security Resources for Open Source | ECI Research

OpenSSF Expands AI Security Resources for Open Source | ECI Research

AI, Application Development, DevSecOps, Events, KubeCon + CloudNativeCon NA 2026 /

OpenSSF announced new members, a developer guide to AI-assisted vulnerability management, a new SAIA certification, and expanded malicious package coverage across eight ecosystems. The moves address a structural gap between AI-accelerated code production and security teams’ ability to keep pace. ECI Research analysis explains what it means for government and enterprise ITDMs and developers.

OpenSSF Expands AI Security Resources for Open Source | ECI Research Read More »

Chainguard Athena: Fixing AI-Accelerated Vulnerabilities at Scale

Chainguard Athena: Fixing AI-Accelerated Vulnerabilities at Scale

Application Development, DevSecOps, Open Source, Supply Chain /

Chainguard has launched Athena, an industry coalition designed to close the gap between AI-accelerated vulnerability discovery and actual remediation. With 1 billion container build manifests processed, Chainguard has the scale to back its ambitions. ECI Research data reveals why inconsistent SBOM practices and compliance friction make this problem harder than it looks.

Chainguard Athena: Fixing AI-Accelerated Vulnerabilities at Scale Read More »

Cloudsmith's Confidence Gap: Supply Chain Security's Blind Spot

Cloudsmith’s Confidence Gap: Supply Chain Security’s Blind Spot

Application Development, Application Security, DevSecOps /

Cloudsmith’s Confidence Gap Report exposes a critical disconnect: most engineering teams believe their tooling stops install-time attacks, but fewer than half scan dependencies before they enter their environment. The gap between perceived and actual supply chain security is the vulnerability. This note examines what it means for developers, ITDMs, and regulated-sector organizations.

Cloudsmith’s Confidence Gap: Supply Chain Security’s Blind Spot Read More »

GenAI Cuts OSS Coding Time 50%—But Governance Lags | ECI Research

GenAI Cuts OSS Coding Time 50%—But Governance Lags | ECI Research

AGNTCon + MCPCon North America 2026, AI, Application Development, Automation, DevSecOps, Open Source, PyTorch Conference /

The Linux Foundation’s new study finds generative AI cuts open source coding time by up to 50%, but floods projects with low-quality AI-generated pull requests. With only 35% of projects holding a formal GenAI policy, governance has not kept pace with adoption. ECI Research breaks down what enterprise buyers and developer teams need to do about it.

GenAI Cuts OSS Coding Time 50%—But Governance Lags | ECI Research Read More »

CRA Compliance, AI Security, and Open Source Sovereignty | ECI Research

CRA Compliance, AI Security, and Open Source Sovereignty | ECI Research

AI, Application Development, Compliance, Cyber Security, Events, Open Source, Open Source Summit Europe 2026 /

OpenSSF leadership and Linux Foundation policy panelists at Open Source Summit Europe 2026 converged on three urgent themes: CRA compliance readiness is dangerously low, AI-assisted development is outpacing security governance, and Europe’s open source sovereignty gap is a services problem, not a software problem. ECI Research overlays survey data to show what this means for ITDMs and developers navigating regulated environments.

CRA Compliance, AI Security, and Open Source Sovereignty | ECI Research Read More »

GitLab's Governed Software Factory: What It Means for DevSecOps

GitLab’s Governed Software Factory: What It Means for DevSecOps

Application Development, DevSecOps, Enterprise Software /

GitLab announced a connected governed software factory spanning artifact management, dependency firewall, secrets management, and AI impact analytics. The move addresses fragmented pipeline governance and rising supply chain risk from agentic development. ECI Research data shows why platform integration velocity and FedRAMP friction are the real decision drivers.

GitLab’s Governed Software Factory: What It Means for DevSecOps Read More »

OpenSSF, AWS, and the New Stakes of Open Source Security Compliance

OpenSSF, AWS, and the New Stakes of Open Source Security Compliance

Application Development, Compliance, Cyber Security, Events, Infrastructure, Open Source, Open Source Summit Europe 2026 /

OpenSSF announced four new members and a suite of EU Cyber Resilience Act readiness resources at Community Day Europe, while AWS elevated to Platinum membership at the Linux Foundation. Together, the moves signal enterprise consolidation around open source security governance as CRA enforcement begins and AI accelerates vulnerability discovery. ECI Research data shows significant gaps between compliance mandates and operational readiness that these initiatives directly address.

OpenSSF, AWS, and the New Stakes of Open Source Security Compliance Read More »

Broadcom Tanzu Platform: Governed AI Agents for Private Cloud

Broadcom Tanzu Platform: Governed AI Agents for Private Cloud

AI, Application Development, Cloud, Enterprise Software, Infrastructure, Machine Learning, VMware Explore /

Broadcom announced AI-ready data foundations for the VMware Tanzu Platform at VMware Explore 2026, pairing hardened agent sandboxes with governed data access inside private clouds. Separately, TrueSource delivers human-verified, commercially supported open source libraries across Java, Python, and Node.js. Together, the announcements signal Broadcom’s bid to own the governed AI agent runtime for regulated enterprises.

Broadcom Tanzu Platform: Governed AI Agents for Private Cloud Read More »