Software supply chain security companies: who they are and how CISOs compare them

CISO Tribune's record files 13 vendors under software supply chain security as of 18 October 2026. Their products control what goes into software and how it is built: open-source packages, build pipelines, artifacts and container images, with software bills of materials (SBOMs) and signed build provenance as the evidence. CISOs compare them on SBOM formats, provenance, pipeline coverage, policy enforcement and data handling.

Key facts

• The EU Cyber Resilience Act's reporting duties apply from 11 September 2026 and most other obligations from 11 December 2027 (EUR-Lex).
• The Cybersecurity and Infrastructure Security Agency (CISA) and partners published new SBOM minimum elements on 29 July 2026 (CISA).
• The Office of Management and Budget (OMB) rescinded the federal secure software attestation mandate on 23 January 2026 (OMB M-26-05).
• Version 1.2 of Supply-chain Levels for Software Artifacts (SLSA), released on 24 November 2025, adds a Source Track (SLSA).
• The National Institute of Standards and Technology (NIST) published a draft Secure Software Development Framework (SSDF) version 1.2 on 17 December 2025 (NIST).
• A self-replicating npm worm compromised more than 500 packages, CISA reported on 23 September 2025 (CISA).

What software supply chain security solutions do

Our taxonomy defines the category as protection of build pipelines, artifacts, container images and package ecosystems against tampering and malicious components. It sits in the application security group beside software composition analysis, static application security testing, secrets detection and application security posture management. Composition analysis lists the components you ship; supply chain security asks whether those components, and the process that assembled them, can be trusted.

The threat model is MITRE ATT&CK technique T1195, Supply Chain Compromise, filed under Initial Access. Its software sub-techniques cover compromised dependencies and development tools (T1195.001) and a compromised software supply chain (T1195.002). XZ Utils shows the pattern: on 29 March 2024 CISA reported malicious code in versions 5.6.0 and 5.6.1 of a compression library found in Linux distributions.

In practice the products do five jobs, and "platform" usually means a vendor sells several of them:

• Inventory: generate SBOMs from source, builds or binaries, and ingest suppliers' SBOMs.
• Gate: block malicious or risky packages at a registry proxy, pull request or release gate.
• Harden: supply minimal container images and libraries rebuilt from source.
• Prove: sign artifacts and produce or verify build provenance.
• Watch the pipeline: inspect continuous integration and delivery (CI/CD) workflows, runners and the tokens they hold.

Out of scope: firmware and hardware integrity, which we file under firmware and device supply chain security, and supplier questionnaires and ratings, filed under third-party risk.

What the standards and regulators require

United States: from mandate to contract term

Executive Order 14028 of 12 May 2021 started the modern rulebook. Section 4 ordered NIST guidance on supply chain practices, including giving purchasers an SBOM for each product and attesting to secure development practices. It gave the Department of Commerce 60 days to publish minimum elements for an SBOM.

NIST answered with SP 800-218, the SSDF version 1.1, in February 2022. It groups practices into Prepare the Organization, Protect the Software, Produce Well-Secured Software and Respond to Vulnerabilities. Task PS.3.2 asks producers to collect and share provenance data for every component of each release, for example in an SBOM. For the buyer's side, NIST SP 800-161 Revision 1 (May 2022, updated 1 November 2024) sets cybersecurity supply chain risk management practices.

Executive Order 14306, signed on 6 June 2025, ordered a preliminary SSDF update by 1 December 2025 and a final version within 120 days of it. NIST published the SSDF 1.2 draft on 17 December 2025; comments closed on 30 January 2026. NIST's publication page still lists it as an initial public draft, so version 1.1 is the final text to map products against.

OMB's Memorandum M-26-05 of 23 January 2026 rescinded the attestation memoranda M-22-18 and M-23-16. Agencies may still use the attestation form, and may adopt contract terms requiring a current SBOM on request; for a cloud platform, an SBOM of the runtime production environment. Our read: the SBOM survived as a contract clause, and a contract clause is a lever any private buyer can copy.

CISA's Secure by Design programme frames the producer's duty: security of customers as "a core business requirement," in CISA's words, rather than a feature. It is voluntary guidance; we think its principles make good supplier questionnaire items.

SBOM minimum elements, 2021 and 2026

The National Telecommunications and Information Administration (NTIA) published The Minimum Elements For a Software Bill of Materials on 12 July 2021. It set three areas: data fields, automation support and practices. The seven fields are supplier, component name, version, other unique identifiers, dependency relationship, author of SBOM data and timestamp. SBOMs must travel in SPDX, CycloneDX or Software Identification (SWID) tags and list at least all top-level dependencies.

The 2026 Minimum Elements, released by CISA and partners on 29 July 2026 after more than 90 public comments, add Component Hash Algorithm, Component License, SBOM Tool Name and SBOM Generation Context. Supplier Name becomes Component Producer. The elements now apply to all software, including open-source, artificial intelligence (AI) software and software as a service (SaaS). Ask every vendor when its exports will carry the new fields.

Formats: SPDX and CycloneDX

The Software Package Data Exchange (SPDX) is published as ISO/IEC 5962:2021, dated 24 August 2021, and that ISO edition is SPDX version 2.2.1. ISO marks it to be revised, while the SPDX project lists 3.0 as its current version. CycloneDX, from the Open Worldwide Application Security Project (OWASP), covers SBOMs plus SaaS, cryptography, hardware and AI or machine learning bills of materials, and Vulnerability Exploitability Exchange (VEX) statements. Ecma International publishes it as ECMA-424: first edition June 2024, second edition December 2025, defining CycloneDX 1.7.

Provenance: SLSA and Sigstore

SLSA grades how far a build's provenance can be trusted. The Build track has three levels above zero:

Version 1.2 adds a Source Track for the authoring, review and management of source code, with Build Environment and Dependency tracks in development. Sigstore signs artifacts with short-lived keys and records each signature in a public transparency log, so a buyer can verify an artifact without managing the producer's keys.

European Union: the Cyber Resilience Act

Regulation (EU) 2024/2847 of 23 October 2024 sets horizontal cybersecurity requirements for products with digital elements. Its dates of application:

Article 14 requires an early warning within 24 hours of a manufacturer becoming aware of an actively exploited vulnerability, sent to the designated coordinator computer security incident response team (CSIRT) and to ENISA, the EU cybersecurity agency. Annex I requires an SBOM in a machine-readable format covering at least top-level dependencies. Article 13 requires due diligence on third-party components, open-source included, and a support period of at least five years unless the product's expected use is shorter. Breaches of Annex I or Articles 13 and 14 carry fines of up to 15 million euros or 2.5 percent of worldwide annual turnover, whichever is higher.

Software supply chain security companies on our record

On CISO Tribune's record as of 18 October 2026, 13 vendors file under software supply chain security. Three name it as their primary category; the other 10 carry it as a secondary one. Of those 10, three are primarily application security posture management vendors, two each sell composition analysis or static testing, one sells cloud-native application protection, one secures firmware and devices, and one governs workforce AI use.

Ownership on the record: none is publicly traded, four are private, and one is owned by a parent (Veracode, acquired by Thoma Bravo in 2019). The other eight have no ownership recorded yet. Four are headquartered in the United States, two of them in Boston; the other nine have no headquarters recorded yet.

All sell into the path from a developer's keyboard to production; they differ in the point on that path they control:

• Hardened components: Chainguard sells container images, libraries and virtual machine images rebuilt from source.
• Repository and package gates: Phoenix Security sells a supply chain firewall for build and dependency pipelines; Sonatype sells a repository manager and a repository firewall that blocks risky open-source components.
• SBOM management: Anchore generates, imports and manages SBOMs; Finite State builds them from firmware, binaries and supplier SBOMs.
• Build provenance: Archipelo records software production events, including AI agent actions, as execution provenance.
• Posture platforms that list supply chain as a secondary category: Cycode and Legit Security, which correlate findings from code and other sources.
• Testing suites with dependency scanning: GitHub Advanced Security, Snyk and Veracode.
• Cloud and AI tooling: Aqua Security scans code and images before deployment; Pluto Security controls AI tools, agents and extensions.

The full list is below the guide, alphabetical and unranked.

How CISOs compare software supply chain security platforms

Four decisions matter more than the feature grid.

Block before, or report after. A registry proxy or package firewall stops a bad package before any build pulls it; a scanner reports it afterwards. After the September 2025 npm worm and the Axios compromise of 31 March 2026, CISA told organizations to check lock files and the machines that ran npm install. Its Axios advice included installing only packages published at least seven days earlier, a rule worth asking any gate to enforce.

Protect the pipeline, not only the code. The tj-actions compromise of March 2025 exposed secrets such as access keys and tokens. Ask how a product sees CI/CD workflows, pinned action versions and token scope.

Suite or specialist. Ten of the 13 vendors on our record file supply chain security as a secondary category, usually beside a posture, testing or cloud product. Our read: a suite means fewer consoles, but trial the supply chain module on its own terms rather than accepting it as part of the bundle.

Code access and exit. Many of these tools need read access to source code, pipelines and the tokens inside them. Treat data residency, model-training terms and export rights as contract items, not checkboxes.

What a proof of concept should test:

• Generate SBOMs for three of your own applications and validate them against the 2026 minimum elements.
• Pull a known malicious package version through the gate and time the block.
• Import a supplier SBOM and confirm that a newly published vulnerability in one of its components raises an alert.
• Verify the signature and provenance of one release end to end.
• Seed a CI/CD workflow with an over-permissioned token and an unpinned action.
• Export everything, then rebuild one report outside the tool.

What changed in 2025 and 2026

• Package and pipeline compromises drew CISA alerts: on tj-actions on 18 March 2025, the self-replicating npm worm on 23 September 2025 and Axios on 20 April 2026.
• A vendor on our record bought malicious-package technology. SecurityWeek reported on 7 January 2025 that Veracode acquired Phylum assets, including its malicious package database and package firewall, to fold into its composition analysis product.
• Federal policy moved from a mandate to agency discretion. Executive Order 14306 reset the SSDF timetable on 6 June 2025, and M-26-05 rescinded the attestation mandate on 23 January 2026.
• The specifications moved: SLSA 1.2 on 24 November 2025, the SSDF 1.2 draft on 17 December 2025, ECMA-424's second edition in December 2025 and CISA's 2026 SBOM elements on 29 July 2026.
• The Cyber Resilience Act's 24-hour reporting took effect on 11 September 2026.

Related reading

Neighbouring categories: software composition analysis, secrets detection and static testing. A supply chain compromise can become a disclosure question; see the Item 1.05 materiality guide, the SEC disclosure rules for CISOs and the 10-K governance disclosures on the record. For AI coding agents, read AI governance for CISOs; for terms, the glossary; for who owns the budget, reporting lines.