September 2026 Summaries

Traditional vulnerability scans provide only point-in-time results that can quickly become outdated as new CVEs emerge, with an average of 234 reported daily, while frequent full rescans are resource-intensive due to large repository sizes, accumulated advisories, and the complexity of container images. Continuous risk detection instead uses vulnerability-centric matching of package URLs in threat advisories against persistent package metadata, enabling near-real-time identification of newly disclosed vulnerabilities without repeating full package analyses. Running at the artifact registry layer can provide visibility across packages, dependencies, and builds throughout the software lifecycle, while Cloudsmith’s implementation uses OSV.dev threat data and can trigger security and policy-as-code controls when matches are found. Because both scanning and matching depend on known vulnerabilities, cooldown policies that delay use of newly released packages can supplement detection by allowing time for emerging threats, including potential zero-days, to be identified.

Cloudsmith describes a registry-layer security control plane that uses Open Policy Agent and Rego-based policies to assess software artifacts against risk signals such as CVE severity, EPSS exploit likelihood, licenses, package age, metadata, and Docker SBOM contents. Its configurable cooldown policies delay access to newly published packages to reduce exposure to potential zero-day supply-chain attacks while threat information emerges. Continuous risk detection updates package assessments as OSV.dev receives new vulnerability, exploitability, or malicious-package data, allowing policies to automatically take actions such as quarantining affected artifacts. Each evaluation generates queryable decision logs documenting the inputs, actions, and rationale, supporting incident response and compliance evidence for standards including SOC 2, DORA, FedRAMP, PCI-DSS, and the CRA. Together, these capabilities are presented as a continuous alternative to point-in-time scans and CI pipeline gates for managing open-source dependency risk.