Cloudsmith raises $23M to improve software supply chain security
Summary
The software supply chain is notoriously porous: A reported 81% of codebases contain high- or critical-risk open source vulnerabilities. A single vulnerability can have a far-reaching impact on the wider software supply chain, as evidenced by the likes of the Log4Shell exploit that saw millions of applications exposed to potential remote code execution hacks via the Log4j logging library.Northern Irish startup Cloudsmith is setting out to solve this exact problem with its cloud-native artifact management platform, which it touts as a more modern alternative to legacy software supply chain platforms such as JFrog or Sonatype.To help drive its next phase of growth, the startup on Monday said it has raised $23 million in a Series B round of financing led by TCV, with participation from Insight Partners and some returning investors.An artifact, in the context of Cloudsmiths industry, refers to any software package, binary file, or component that is created or distributed throughout the software development process. This could be libraries and their dependencies, configuration files, compiled applications, and more.While a company will usually write its own code, it typically relies on third-party packages stored on public open source registries. Cloudsmith ensures builds are repeatable and reliable, and provides centralized DevOps or platform engineering teams with visibility into whats going into their production software.But even if a package is still available in an open source repository, it can develop security issues over time due to lack of maintenance, or for more nefarious reasons. The second tranche came shortly after Carson transitioned into the chief strategy officer role and Twilio chief customer officer Weinstein came in as CEO.According to Carson, bringing in an experienced startup and scale-up entrepreneur enabled the two co-founders to focus more on the product vision, roadmap and architecture, while opening it to a wider array of enterprises and investors in the U.S. including TCV and Insight Partners.These investors are a strong signal that Cloudsmith has shifted into category leadership, Carson told TechCrunch over email.
Funding
Review available funding amount, funding date, investors, and linked company information related to Cloudsmith raises $23M to improve software supply chain security in the interactive ISVWorld profile.