Securing AI & Software Supply Chains · DevSecOps · AppSec
Stop scanning harder.Change the supply.
Most programs scan what they have already accepted. We change what you accept. RockPoint Cyber controls what enters your software supply chain, protects how it is built, and proves what you ship — fewer components, from sources you can verify, with the trust relationships underneath them enforced: who may publish, what may enter a build, what must be signed before release.
Every engagement runs on Gantry, our software supply chain knowledge graph, connecting capabilities, threats, controls, tools and evidence to your environment. We have been building it for over a decade, which is why week one is a working model of your estate rather than a discovery workshop.
- Less avoidable risk, removed rather than re-prioritized
- Security investment you can defend line by line
- Engineering teams equipped to sustain the work after we leave
- Base image CVE findings
- 1,284→11
- Mean time to patch a base image
- 21 days→< 1 day
- Dependency alerts reaching a developer
- 100%→9%
- Artifacts with signature, SBOM and provenance
- 0%→100%
components removed, not suppressed
supplier rebuild, not internal triage
reachability-filtered
verified at admission
Modeled scenario, not a measured client outcome. These are the targets an engagement is scoped against when the supply is changed rather than re-scanned; the starting posture sets what is achievable, and each is modeled per client in Gantry before it is committed to.
Why the scanner did not help
11 of the last 16 we model had nothing to scan for.
Modeled supply chain incidents, 2024 to today
A mark is one incident, placed at the month it became public. Accent means no CVE identifier was ever assigned — so there was nothing for a vulnerability scanner to match against, before or during. It does not mean a scanner would necessarily have caught the other 5. The xz-utils backdoor had one, and was found by a developer investigating half a second of latency.
- HuggingFaceMalicious models on Hugging Face, 2024-02, no CVE was ever assigned, 4 capabilities counter the techniques it used.LottieLottie Player wallet drainer, 2024-10, no CVE was ever assigned, 11 capabilities counter the techniques it used.tj-actionstj-actions/changed-files GitHub Action compromise, 2025-03, a CVE was assigned, 20 capabilities counter the techniques it used.Shai-HuludShai-Hulud self-propagating npm worm, 2025-09, no CVE was ever assigned, 14 capabilities counter the techniques it used.
- xz-utilsxz-utils backdoor, 2024-03, a CVE was assigned, 21 capabilities counter the techniques it used.web3.js@solana/web3.js private key exfiltration, 2024-12, a CVE was assigned, 13 capabilities counter the techniques it used.GlueStackGlueStack react-native-aria compromise, 2025-06, no CVE was ever assigned, 11 capabilities counter the techniques it used.axiosaxios compromise (UNC1069, WAVESHAPER.V2), 2026-03, no CVE was ever assigned, 15 capabilities counter the techniques it used.
- SisenseSisense credential exposure, 2024-04, no CVE was ever assigned, 13 capabilities counter the techniques it used.UltralyticsUltralytics PyPI release compromise, 2024-12, no CVE was ever assigned, 15 capabilities counter the techniques it used.eslint-prettiereslint-config-prettier phishing compromise, 2025-07, a CVE was assigned, 13 capabilities counter the techniques it used.
- polyfill.iopolyfill.io CDN takeover, 2024-06, no CVE was ever assigned, 12 capabilities counter the techniques it used.NxNx s1ngularity campaign, 2025-08, no CVE was ever assigned, 19 capabilities counter the techniques it used.TeamPCPTeamPCP campaign — Trivy, Checkmarx KICS and LiteLLM, 2026-03, a CVE was assigned, 28 capabilities counter the techniques it used.
- chalk/debugnpm maintainer phishing — chalk and debug, 2025-09, no CVE was ever assigned, 11 capabilities counter the techniques it used.
- TanStackTanStack npm compromise (Mini Shai-Hulud), 2026-05, no CVE was ever assigned, 16 capabilities counter the techniques it used.
A compromised maintainer account, a typosquat, a post-install script, an action retagged under you, a CDN that changed hands. None of these produce a vulnerability to match against, so known-vulnerability scanning does not cover them. Scanning is necessary and it is not a supply chain security program — the control that reaches these is knowing what you accept, from whom, and what it is allowed to do once it arrives.
The other half
For every incident here we can map capabilities that would have interrupted a documented step or limited its blast radius — a median of 14 per incident, none of which is “scan more often”. That is a starting list, not a guarantee any one control would have prevented the whole chain. It is what we build an engagement from.
The chart shows the most recent 16 of a curated set of 44public incidents we model — not a representative sample of all supply chain attacks. Across the full set, 33 had no CVE identified at review; the recent window is the harder case, because identifiers are increasingly assigned after the fact. Every entry, its techniques and its countermeasures come from Gantry and each one names its sources.
See what we would check firstAnd the ones that did have a CVE
The feed your program prioritizes from is incomplete, late and often wrong.
Severity scoring is the input to every risk decision a security program makes — which tickets open, which releases block, which exceptions get signed. In a study set of 1,718 open source CVEs disclosed in 2025, that input was not reliable enough to carry the weight placed on it.
65%
of open source CVEs carry no NVD severity score
Leaving roughly 600 that could actually be triaged from public data
46%
of those unscored CVEs were High or Critical on review
Severity absent from the feed, not absent from the risk
41 days
median NVD time-to-score, with 35% past three months
Exploit proofs and upstream patches land in hours
167,286
false negatives — exploitable components never flagged
Against 20,362 false positives in the same analysis
Meanwhile the supply keeps arriving.
Three pressures compound on the intake side, and none of them is addressed by triaging faster. Malicious publishing is now industrial. AI assistants are making dependency decisions at a rate no review process was sized for. And a measurable share of what is already in your graph can never be patched, because nobody upstream maintains it.
Each is a decision about what you accept, made before a scanner ever runs. That is the layer we work on.
454,648
new malicious packages observed by one vendor in 2025
1.23 million logged since 2019 across npm, PyPI, Maven, NuGet and Hugging Face. An observed count, not a census of all attacks
27.8%
of LLM upgrade recommendations in one experiment were hallucinated
Across 36,870 recommendations; over 10,000 versions that do not exist. One model, one task — not a general AI error rate
5-15%
of components in enterprise dependency graphs are end-of-life
Unpatchable by definition: scan-to-ticket-to-patch produces a backlog, not a fix
Figures from the 2026 State of the Software Supply Chain, Sonatype: a study set of 1,718 open source CVEs disclosed in 2025, 36,870 dependency upgrade recommendations, and malicious packages observed by that vendor rather than a count of all attacks worldwide. We did not produce these numbers and have no stake in them, which is most of why they are here.
Black October · October 2026
Three compromises in four days, none of which a scanner was going to find.
Four days in which a certificate authority's keys were recovered, an AI gateway shipped a credential stealer, and a pair of PHP flaws found with AI assistance put remote code execution in reach of most of the web. Not one of them was a vulnerability in code you wrote, and not one of them would have been caught by scanning your own repositories harder.
- 21 Oct
PHP2Shell
Two unauthenticated RCE flaws in PHP, reaching back to 5.4. Found with AI assistance; patched the same day; the NSA issued an advisory and operators worldwide took sites offline.
AI shortened the distance from research to working exploit, on a runtime nobody inventories.
- 21 Oct
LiteLLM
Release infrastructure compromised with stolen developer credentials and an altered release workflow. Malicious 1.107.0 on PyPI for 104 minutes, matching container images on Docker Hub.
The window was under two hours. Anything resolving a floating version in that window shipped a credential stealer.
- 17-22 Oct
eMudhra
Private keys for eight intermediate certificate authorities proved recoverable, generated with insufficient randomness in a 2025 key ceremony. Chrome and Firefox revoked them; the CA left the TLS business.
Trust roots are a supply chain, and this one failed at the ceremony rather than at the perimeter.
The common factor is the clock. LiteLLM was malicious for 104 minutes. A pipeline that resolves a floating version, on any build triggered in that window, shipped the credential stealer and had no finding to show for it. The control that stops this is not faster scanning — it is a shorter list of things you accept, from publishers you can name, pinned to digests you verified.
The differentiator
Most firms start with a promise. We start with Gantry.
Software supply chain security is the one security domain nobody has managed to define. It is tools, vendors, products, capabilities, framework controls, people, processes, attacks and evidence, all bearing on each other at once — which is why most advice about it is opinion wearing a methodology.
Gantry is a working model of that ecosystem, built and corrected over more than a decade. It is a knowledge graph, and that matters for the reason graphs exist at all: the value was never in the things, it was in how they connect. Which capability closes which attack technique. Which control a tool genuinely evidences, as opposed to what its datasheet claims. Those relationships are the decade of work, and no vendor grid contains them.
So an engagement does not start from a blank page. A toolchain rationalization, a capability assessment that decides whether you hire or buy, a rollout plan, a cost of ownership argument — each is a query against a model we already trust, not a spreadsheet someone assembled for your account last week.
“Defenders think in lists. Attackers think in graphs. As long as this is true, attackers win.”
Gantry / the connected view
Capabilities connect everything.
The core of Gantry
Capabilities
What your supply chain must be able to do.
- Verify what you use
- Protect how you build
- Control what you ship
How you deliver them
- PeopleRoles and expertise
- ProcessesPractices and workflows
- ToolsProducts and services
What they answer to
- RequirementsWhat you must meet
- RisksWhat you must reduce
- EvidenceHow you demonstrate it
- MaturityWhat to improve next
Across your software delivery lifecycle
- Plan
- Code
- Build
- Test
- Release
- Deploy
- Operate
- Monitor
What is modeled
- 200+
- capabilities
- 300+
- products mapped
- 500+
- framework controls
- 100+
- attack techniques
19,000+
modeled relationships, across 150+ distinct kinds. This is the part that took ten years.
Our philosophy
Most engagements start at zero. Ours start eighty yards downfield.
We are independent consultants, not a product company and not a reseller, so the recommendation is whatever the evidence supports — including that you should spend nothing. What we bring instead of a methodology is more than a decade of modeled judgment about how this field actually fits together: the part that cannot be assembled during a discovery phase, and cannot be inferred by a model that has never seen your pipeline.
How it usually goes
How we work
Week one is discovery. You pay a team to learn your estate, your pipeline and your vendors from the beginning, and the learning leaves with them.
Day one
The model is already built.
Discovery confirms or corrects what we can already describe, which takes days rather than a quarter — and what it corrects stays in the model.
The rollout plan arrives at the end, in slides, written by whoever was free that week.
The plan
Generated before anyone signs.
Ask how a Chainguard adoption would actually run and it comes out of the graph — phases, gates, owners, and the tasks underneath them.
The firm recommending the tool resells the tool, or holds a partner tier it would rather not lose.
Incentives
Nobody here is paid when you buy.
We sell no licenses, hold no partner tiers and take no referral fees. “Keep what you already run” is a conclusion we publish, with the numbers that produced it.
An opinion, delivered with confidence, traceable to nobody's data but the speaker's.
Evidence
Every claim opens.
The capability, the framework control it lets you evidence, the attack technique it counters, what it costs to operate. Disagree with any link and we will show you the one underneath it.
Ask a general model and hope it has read enough of the internet to be right about you.
Context
Retrieval was never the hard part.
More than a decade of captured judgment, where the relationships between tools, controls, threats and people are modeled rather than inferred.
The knowledge leaves when the invoices stop, and the next firm starts over.
Afterwards
The deliverable is engineers who no longer need us.
We mentor inside your repositories, and teach the model with a board game your non-technical stakeholders will argue over.
Services
Three service lines, one thesis.
These are the lines of work, not a menu of tools. Each attacks the same root cause from a different angle — what enters the build, what your team spends attention on, and whether the people who ship code understand why any of it matters — and each draws on whichever of our tools the engagement actually needs.
- 01Read →
Software Supply Chain Modernization
Fix the supply. The backlog takes care of itself.
- Open source ingestion governance
- Hardened base image strategy
- Reachability-based prioritization
- Signing, SBOM and provenance
- Admission verification
- Pipeline identity separation
- 02Read →
Toolchain Rationalization & Investment Strategy
Know what you own, what it actually covers, and what you can safely stop paying for.
- Capability coverage map
- Overlap and consolidation analysis
- Product selection and battle cards
- Regulatory coverage mapping
- Signal economics
- Gate and orchestration design
- 03Read →
Engineering Enablement & Embedded Mentoring
The deliverable is engineers who no longer need us.
- Embedded mentoring
- Role-based curriculum
- Security champions program
- Threat modeling practice
- DevSecOpoly workshops
- Maturity assessment and roadmap
Start smaller
Most of this work does not need a new pipeline.
Bounded before they start and run on the estate you already have. Ten are fixed-fee projects that finish inside a quarter; two are retainers. If a transformation follows it is because the findings justified one — which is a better reason than our proposal saying so.
- 01
Supply Chain Diagnostic
You do not need a new pipeline to know exactly where you would bleed.
Two to three weeks, fixed fee · CISO · Engineering
- 05
CRA Readiness Check
The obligations have dates. This establishes which ones you already miss.
Two to three weeks, fixed fee · Compliance · Legal · CISO
- 02
Estate Rationalization Review
Find the duplicated spend before the renewal, not after it.
Three weeks, fixed fee · CFO · CISO
- 08
Trust and Identity Audit
Inventory the access an attacker would actually use. None of it has a CVE.
Two weeks, no pipeline change · CISO · Engineering
The one with a date on it. EU Cyber Resilience Act reporting has been live since September 2026; full application is in 410 days, carrying penalties up to €15 million or 2.5% of worldwide turnover. If you place products on the EU market and have not scoped it, that is the engagement to start with.
Toolchain rationalization
The fastest security budget you will ever recover is the one you are already spending twice.
Most estates are paying for the same capability two or three times over, in tools bought by different teams in different years for reasons nobody wrote down. Consolidation finds that money — but only if the decision about what goes is defensible, because the alternative is cutting the tool with the weakest advocate rather than the weakest case.
Two decisions, same method
Both of these are live and recompute when you open them. One concludes that two well-regarded scanners are both worse value than fixing what the organization already runs. The other concludes that two products should be bought together and split by workload. The products did not decide that. The context did.
- Static Application Security TestingBuy nothing yet
Close the gap before buying.
- Snyk Code
- Veracode Static Analysis
Against an organization that already scans, both cost more than the risk they remove. Snyk covers the wider set — pre-commit checks, AI-generated code detection, review assistance — and Veracode reaches binaries the others cannot read, but most of what either adds is capability the existing scanner already has. The remaining gap is narrow enough that open-source projects close a large share of it for nothing, and the money is better spent on the people to operate what is already running.
Open the comparison → - Endpoint Detection and ResponseIt depends
Run both, split by workload.
- Microsoft Defender for Endpoint
- CrowdStrike Falcon Insight
Across seven organization shapes the same two products produce seven different recommendations, and the answer changes hands five times. Under 500 seats the managed tier wins because there is no SOC to staff. Already on Microsoft 365, the gap is a license tier rather than a product. At enterprise scale with a mixed estate, neither covers it alone and the integration cost is worth paying.
Open the comparison →
Why the published answer is usually wrong for you
Every comparison is written to win
Vendor battle cards exist to close deals, and they are built by picking the axes their product wins on. That is not dishonesty, it is the job — but it means the feature grid you are reading was reverse-engineered from a conclusion.
The independent sources have their own pressures
Analyst grids are funded by the vendors placed on them, and inclusion often depends on revenue thresholds rather than capability. Community write-ups are genuinely independent, and were accurate the year they were written.
Nobody is modeling your environment
The decisive inputs — what you already run, what your pipeline looks like, which languages you ship, who you can staff, what you can spend — are the ones a public comparison cannot see. So it answers a general question while you are asking a specific one.
Behind both comparisons: 25 capability domains, 340 products from 203 vendors, and the licenses, staffing and open-source alternatives attached to each. Your pipeline, languages, existing tools, skills and budget are inputs to that model rather than caveats at the end of it. The whole model is public.
Resources
The engine, pointed at your problem.
We are productizing the outputs of our advisory work. Each tool runs against the same model our consultants do, so what you get for free is a genuine slice of the engagement rather than a lead-capture form with a chart on it.
- AnalysisLive
Vendor Risk Rationalization
Compare products on the capabilities they genuinely cover, then right-size the whole portfolio — tier by real exposure, consolidate the overlap, prune what nobody owns.
CISOs, GRC and procurement
- AssessmentIn beta
Software Supply Chain Maturity Assessment
Score against the same ladders our assessments use, then get the next activities ranked by expected loss reduction rather than by level.
CISOs, security program owners
- ReferenceIn beta
Periodic Table of Software Supply Chain Security
Every modeled capability and every product on one grid, where a tile’s position tells you what it protects and how much program maturity it demands.
Anyone mapping the field
- Design toolIn beta
Secure Pipeline Builder
Assemble a delivery pipeline stage by stage and watch the controls, threats and framework coverage resolve at every step.
Platform and security architects
- Incident readinessIn development
Exposure Answer
Which of your services run it, which are genuinely exposed, and how long it took you to find out.
CISOs, incident response, platform teams
- Training gameLive
DevSecOpoly
A cooperative board game that teaches the software supply chain by making a room of people defend one.
Engineering, executives, champions programs
Featured tool
DevSecOpoly
A cooperative board game for teaching software supply chain security to people who do not write code, and to people who do. There is no winner. The team shares one budget, one breach meter and one goal: harden the supply chain before it is compromised.
Every space, card and briefing is read live from Gantry, so the board teaches the same capability model our assessments measure against. Players tick the real maturity ladder for each category and see where the game has built further than their own organization has.
- spaces
- 40
- capability categories
- 22
- cards
- 66
- players
- 2–6
Writing
Field notes.
What we are seeing in real supply chains, written for engineers rather than for buyers.
Start here
Bring us the backlog you have stopped reading.
A two-week diagnostic gets you a capability map of what you own, a ranked list of what is genuinely missing, the overlap you are paying twice for, and a sequenced plan. It is a report you can take to a budget conversation, whether or not you work with us after.
Prefer to look around first? The tools run on the same engine our consultants use.