September 2023 Summaries

This month, I was named as the new CEO of Cloudsmith, a software supply chain platform company. I'm joining Alan Carson and Lee Skillen to build the world's most powerful software supply chain platform. The transition has been underway since August 21, when I joined Cloudsmith's HQ in Belfast, Northern Ireland. I've spent the past month meeting Cloudsmithers, customers, and investors, as well as having long talks with Alan about his journey as founding CEO. As former Chief Customer Officer at Twilio, I understand the need for a deep stack of dependencies and the complexity of building and deploying software. Cloudsmith aims to control what comes in and what goes out, providing observability, security scanning, license checking, performance monitoring, and other value-added services to CI/CD pipelines. The company is built from the ground up as a massive scale, multi-tenant Software as a Service (SaaS), making it a big reason I've chosen to join. Cloudsmith is poised to displace seemingly comfortable incumbents with its innovative approach, delivering global scale and innovating faster.

Steve Jobs' three-step plan for success is that a contrarian idea must be proven right and executed massively. This concept resonated with Cloudsmith's co-founder and CEO Alan as the company built its Software Supply Chain Management (SSCM) platform, initially facing challenges in popularizing this issue. However, after identifying a strong go-to-market leader, Glenn Weinstein, who had a history of success growing startups and serving the software development community, Cloudsmith was able to execute on its vision with renewed momentum. The company's bold move paid off as Glenn joined within four months, bringing his exceptional people skills, awareness, and positive attitude to the team, positioning Cloudsmith for long-term growth and success.

Cloudsmith has recently released a suite of Policy Management features to help streamline security operations and ensure efficient governance of software artifacts against lurking threats. The policy management system is designed with ease of use, flexibility, comprehensive coverage, compliance enforcement, authentication policies, license policies, and vulnerability policies in mind. These features aim to simplify complexity, flag or quarantine packages that fall under an organization's "do not use" category, automate license checks, detect and address vulnerabilities as early as possible, and offer granular controls for specifying actions based on package names, versions, or version groups. Cloudsmith's policy management system is designed to provide a centralized approach to define, implement, and enforce rules and protocols related to software artifacts, ensuring consistent application of security measures across the board. The platform aims to prevent scenarios like John Deere's non-compliance with GPL, which highlights the importance of license compliance, and offers teams the tools they need to stay ahead of potential risks in a rapidly evolving technology landscape.