Chainguard Bags Massive $50M Series A for Supply Chain Security

Venture capital powerhouse Sequoia is leading a massive $50 million early-stage investment in Chainguard, a startup created by a team of ex-Google software engineers to “make software supply chain secure by default.”

The Series A funding comes less than six months after Chainguard emerged from stealth with $5 million in seed capital and signals massive investor interest in technology to address weaknesses in the software supply chain.

In addition to Sequoia Capital, Chainguard’s massive Series A attracted the attention to Amplify, Chainsmokers’ Mantis VC, LiveOak Ventures, Banana Capital, K5/JPMC and several prominent angels.

Chainguard also rolled out its first product, called Chainguard Images, to provide organizations with a secure set of base images that are fully signed with Sigstore and continuously updated with Service Level Agreements (SLAs), Software Bill of Materials (SBOMs) and Certifications (FIPS, SLSA).

“Chainguard Images are the first container base images designed for a secure software supply chain. Chainguard Images are continuously updated base container images that aim for zero-known vulnerabilities,” co-founder and CEO Dan Lorenc said in a note announcing the company’s first product.

[ READ: Ex-Googlers Snag $5 Million for Software Supply Chain Security ]

Sequoia Capital partner Bogomil Balkansky said the pedigree of the founders as engineers in the open-source supply chain ecosystem was key to its investment.

Chainguard was created by Dan Lorenc and Kim Lewandowski and the team that worked on Google’s major supply chain security initiatives — Sigstore and SLSA.

“High profile software supply chain attacks like Log4j have flashed a spotlight on the need to establish a foundation of trust in the software that companies put in production. Chainguard gives companies confidence in the critical open source software they deploy by providing a low-friction, developer-friendly way of signing and verifying software artifacts so they have a trail to trace if a breach does occur. The Chainguard team are thought leaders in this space, and it is the right team at the right time in history to tackle this problem,” Balkansky said.

Chainguard and its investors are betting on a major market for its tools and services as increased attention is paid to hidden weaknesses in the software ecosystem. The company says it is innovating to create a software supply chain where every artifact can be verifiably traced back to the source code and hardware it was built on and by whom.

“[We are] making sense of the chaotic security solutions space by seamlessly integrating security into the software development lifecycle. It’s a holistic, end-to-end solution from development to production to policy management,” Chainguard said.

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series.
Ryan is a veteran cybersecurity strategist who has built security engagement programs at major global brands, including Intel Corp., Bishop Fox and Kaspersky GReAT. He is a co-founder of Threatpost and the global SAS conference series. Ryan’s past career as a security journalist included bylines at major technology publications including Ziff Davis eWEEK, CBS Interactive’s ZDNet, PCMag and PC World.
Ryan is a director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.
Follow Ryan on Twitter @ryanaraine.

Previous Columns by Ryan Naraine: