Securing the Open Source Supply Chain with ActiveState

In this episode, Abby Kearns, CEO of ActiveState, explains how her company closes that gap by rebuilding open-source packages from verified sources before they ever reach a developer's pipeline, rather than scanning for problems after the fact. Joining her are Doug Mayer, vp and CISO at WCG, and Howard Holton, former CEO at GigaOM.

Want to know:

• Why is AI increasing exploitability on both the attacker side and the developer side of the open source supply chain?
• How does a package catalog replace your package manager without slowing developers down or pushing them around the process?
• What does ActiveState do differently than upstream scanning tools like JFrog Artifactory or Sonatype Nexus?
• What happens when a developer needs a package that isn't in the catalog yet?
• How is ActiveState thinking about shadow AI and SBOM coverage beyond language libraries?
• What upcoming regulatory deadlines, like the EU Cyber Resilience Act, should security teams have on their radar?
• What happens to open source security when AI produces more CVEs and patches than the maintainers behind these projects can process?

Huge thanks to our sponsor, ActiveState

ActiveState gives security and engineering teams a single governed source for open source software. With 79 million components built from source, continuously remediated, and delivered directly into the tools teams already use, ActiveState eliminates the CVE backlog and the developer toil that comes with it. Companies see a 60 to 99% reduction in CVEs and reclaim up to 30% of developer time. 


Curate a private, vetted repository of open source components from the ActiveState Library that developers use safely without scouring the internet. A Curated Catalog provides your security team total control over what enters their environments while giving engineering teams a fast, secure way to build, onboard, and start new projects.