In mid-2021, Renee Shah received a tip in her text messages, the kind that just about any venture investor would love to get.
“You can’t miss this deal,” the message read. "The 'Justice League of security' is spinning out of Google.”
Today, that group of former Googlers is better known as the founding team of Chainguard. But true to its billing, the startup is on a daunting mission, aiming to make a big dent in one of the most intractable areas of cybersecurity today.
Over the course of its first year, Chainguard has emerged as one of the most promising players in the effort to curtail the massive security risks of the software supply chain, industry experts told Protocol.
It’s an issue of some urgency: A growing number of attacks seek to use the software development process itself as a vehicle for delivering malicious code into a commercial application, in order to compromise the organizations that use the software, as occurred in the widely felt SolarWinds breach of 2020.
Chainguard stands out thanks to a unique product strategy and strong appeal among developers, as well as the deep experience of the founding team in open-source software and security. That included a combined 35 years at Google working on initiatives such as Kubernetes, the dominant system used in container-based software development, and related open-source projects.
Chainguard's goal "is really to try to make the software development life cycle and software supply chain secure by default," said co-founder and CEO Dan Lorenc, "because that's the only way it will actually get secure."
Chainguard’s products can be used to secure the software supply chain for cloud-native applications in Kubernetes at a more fundamental level than other vendors, according to third-party experts and the company’s founders.
While Chainguard doesn't yet address the whole problem of software supply chain security, "they're solving a really big chunk of it," said Katie Norton, a senior research analyst at IDC.
Still, the company's ultimate goal is to secure the entire software development process, Chainguard's four founders told Protocol in recent interviews.
Supply chain insecurity
Shah, a partner at Amplify Partners, was destined to get an early glimpse of the plans for Chainguard.
Even before getting the “Justice League” tip, Shah had coincidentally just set up a meeting with Lorenc, then a Google engineer, who was a leader of a fast-growing open-source project called Sigstore that would become part of the basis for Chainguard’s products. Amplify went on to lead the startup’s seed round of funding, and Chainguard has now raised $55 million in total funding and has 52 people on staff.
Not only do the Chainguard founders bring uncommon expertise on software supply chain security, but "they are so great at building products that developers really want," Shah said.
If there's such a thing as a superpower in cybersecurity, getting developers to care about a security tool is probably it. For most developers, security is "last on their list," according to Lorenc.
Once a largely obscure concern, the security of the software supply chain became a top priority across the U.S. government and C-suite in the fallout from the SolarWinds breach. The Russia-linked attack, which poisoned a SolarWinds application with malicious code that was then widely distributed across its customer base, was discovered in December 2020.
In response, a deluge of security tools has come to market, many of them geared toward scanning software for vulnerable components.
Such tools do have their uses in reducing software supply chain risk. Chainguard comes at the problem from a different angle, however.
"We're starting all the way back to square one," said Kim Lewandowski, co-founder and head of product at Chainguard. That has included taking the unorthodox step of providing secure building blocks for software, endowing applications with the most secure baseline possible without creating extra work for developers.
Specifically, Chainguard offers its own container base images — files that serve as the foundation of a cloud-native application — which the company says will ship without any known vulnerabilities. This is an advantage because many of the open-source options that are popular with developers come with a large number of bugs from the start.
The company recently took the additional step of creating its own flavor of Linux, dubbed "Wolfi," that is now supporting its secure-by-default container images. Customers of Chainguard get container base images with enterprise-friendly features such as a service-level agreement, which promises any future vulnerabilities that are found will be patched in an agreed-upon timeframe.
Underpinning Chainguard’s products is Sigstore, which Lorenc had co-created while at Google and had generated strong interest from developers as an open-source project. The tool makes it easier for software makers to do what's known as "code signing," a way of proving the authenticity of a piece of software.
The Chainguard images are all digitally signed and include a software bill of materials, which provides transparency into the software's components. Chainguard has also begun manually curating a feed of vulnerability information for customers to help with vulnerability management.
Deploying secure software
At the other end of the chain, the company provides greater transparency into application code, while automatically ensuring that only trusted software is being deployed out to customers.
With its Enforce product, Chainguard provides visibility into code that's being deployed to "production" Kubernetes environments, which is the final step that makes the software available to users.
Having this greater transparency can provide an understanding of the security posture of code that's being deployed. For instance, Enforce can determine what code has been signed (such as through using Sigstore) and can therefore be trusted for deployment to users.
The tool can also determine which software packages included in the code feature a software bill of materials, which can offer further specifics around whether any vulnerable components are being used. Enforce ultimately enables better asset management for software teams, since it "gives you a real-time view of what's running in your production systems," Lewandowski said.
"And so once you get a picture of how scary things might be, then you can start enforcing different types of policies on it," she said.
For instance, a customer could prevent an untrusted container image from getting deployed into a production environment. Or, Enforce could be used to block deployment of a software component with a newly discovered vulnerability — a capability that would prove very handy after the discovery of a critical vulnerability such as last year's flaw in the widely used Apache Log4j component.
An expanding threat
With supply chain attacks, the opportunity to "compromise one, compromise many," by implanting malicious code in a single piece of software destined for a large customer base, has proven highly appealing for hackers.
While the SolarWinds breach affected numerous U.S. federal agencies and thousands of companies, overall attacks against the software supply chain are up as well, surging 300% in 2021 from the prior year, according to a report from Aqua Security.
At the same time, more businesses now have their own internal software supply chains to worry about, as companies of all stripes have begun developing their own software. The widespread use of vulnerability-prone open-source software has only compounded the risks.
Securing the software supply chain is very different from securing employee accounts, or protecting an organization's data. Even calling it the supply chain security “problem” is almost a misnomer, Lorenc said, because in reality “it’s like 37 problems, all rolled into one.”
It's going to take real change from developers, and lots of them, to cause a shift here.
"It's not something a CISO can just buy and bolt on at the end of the [development process], and somehow secure all the steps before that," he said. "It's going to take real change from developers, and lots of them, to cause a shift here."
Google, of course, is a good place to gain expertise on open-source software, developer tools, and cybersecurity. Or to be a pioneer in those areas, as has been the case with Chainguard's four co-founders, who’ve had a hand in many of the notable projects at Google over the past decade.
A sampling of their work at Google: Lorenc launched a popular tool for running Kubernetes container orchestration locally (Minikube), while Lewandowski co-created a trailblazing supply chain security framework, known as SLSA.
CTO Matthew Moore, meanwhile, co-founded the Google Container Registry and led an open-source project to enable serverless containers in Kubernetes environments (Knative), while co-founder Ville Aikas was an early member on the Kubernetes project itself.
With the focus on Sigstore, following the tech industry playbook of building enterprise products on top of open source is one part of the equation for Chainguard. And “having the main authors of open-source projects, on the team that's commercializing that open source, is extremely important,” Shah said.
But the Chainguard founding team also realized that when it comes to the software supply chain problem, the group is well positioned overall, Lewandowski said: "We know this space. We can help people here."
Fixing the foundation
Years before the SolarWinds breach, Santiago Torres-Arias had already been researching the issue of software supply chain security.
Torres-Arias was among the academic researchers who helped to develop in-toto, a federally backed framework for securing software supply chains that likely would have made a difference in mitigating the SolarWinds attack, had it been implemented.
Now that the world is paying attention to software supply chain security, Torres-Arias, an assistant professor at Purdue University, told Protocol he sees a different problem cropping up: There are a huge number of vendors claiming to have the answer, and they really don't.
"It's a complex and nuanced problem. You can't just install this one thing" and secure the software supply chain, he said.
Instead, the solution needs to be built into the supply chain itself, "from the ground up," Torres-Arias said. Chainguard’s container base images make it one of the very few vendors that gets that, he said.
Vendor claims about "shifting left" to bring security earlier in the software development process have been abundant lately. But releasing a new flavor of Linux to make software as secure as possible from the get-go? That's "not something you'll find other companies trying to do," Torres-Arias said.
While many vendors enable remediation of security issues that've been discovered, it's often difficult for developers to actually make the fixes, IDC's Norton said.
Chainguard, she said, stands apart by allowing development teams to "start with a clean slate, which is way easier than having to go back and fix a bunch of stuff."
The rest of the chain
It's no accident that Chainguard has begun with securing "the first and last links" in the software supply chain, said Moore, the company's CTO and co-founder. The goal is for the two products to serve as a strong foundation before the company sets out to work its way through the rest of the supply chain, he said.
The vision is to cover the entire chain over time, and the company is still determining where to go next, both in terms of covering new areas and expanding its existing products, the Chainguard founders said.
"This is going to be a long process of chipping away and fixing things," Moore said. "There's a lot of links in the chain, and they all need to be strong."
For example, midway through the chain, code is converted into an executable program, in what's known as the "build" phase. Investigators believe the initial compromise of SolarWinds was during this phase.
The running theme for Chainguard, however, will be on making it easier for development teams to do the right things in security and harder to do the wrong things, the founders said.
Still, while the development of new software has largely shifted to cloud-native technologies such as containers, many existing applications continue to rely on older technologies such as mainframes, Norton noted.
"There are so many legacy applications that exist, which these newer applications are often built on top of, or connected to," she said. "In the big picture, [legacy applications] also need to be addressed in terms of security."
Focus on developers
But for the development of new software, or updates to existing software in Kubernetes environments, Chainguard has a lot to offer, particularly since the startup is so developer-oriented, Norton said. IDC research has shown that catering to developer needs is "incredibly important" for addressing this issue, she said. Today, to really get supply chain security tools adopted within an organization, "they need to be designed with the developer in mind."
Chainguard's founders say they've modeled the company itself as a developer tools provider, with its products meant to blend into the existing software development process. It's an approach that has been hugely successful for another developer security vendor, Snyk, which ranks at No. 2 among the top-valued private cybersecurity vendors with a valuation of $8.6 billion, according to CB Insights.
For Chainguard, the founders say the aim is to make developers more productive, not less. For instance, Enforce automatically monitors running applications and can notify developers if an app falls out of compliance, sparing them from manual analysis.
Going forward, some accountability for securing software may also end up falling on developers, whether they like it or not. The much-discussed idea of merging DevOps with security — to form a "DevSecOps" approach, where security is a shared responsibility across functions — is one indicator of this trend.
Still, most developers are not security experts, don't want to be, and are mainly under pressure to push out new software. And so for the developer, Aikas said, "security is something that you shouldn't really have to worry about. That's something we should be able to handle for you."
Chainguard has focused on working closely with a small number of customers so far, and will be more aggressive about looking to expand its customer base in 2023, Lewandowski said.
Hewlett Packard Enterprise and Block (the parent company of Square) are among Chainguard's customers. Block has adopted Enforce in place of several homegrown and open-source software supply chain security tools it had been using, according to a customer case study released Monday by Chainguard.
Ultimately, Chainguard is committed to making good on its goal of securing the whole software supply chain, and is not looking for a quick exit, the founders told Protocol. "We'll be here for a while," Lorenc said.
Without a doubt, the company's strategy of trying to fix the software supply chain down to its core, rather than with a "bolt-on" solution, is a “harder road to take," he said. "But if you're going to do this, you might as well do it right."
This story was updated to clarify how Chainguard ships its container base images.
