Inside Platform Engineering with Nigel Douglas

Matthew Allford’s conversation with Cloudsmith Head of Developer Relations Nigel Douglas examines the growing challenge of software supply chain security, emphasizing that modern applications rely on extensive direct and transitive third-party dependencies that many organizations cannot fully identify or track. Douglas argues that attackers increasingly target widely used packages and maintainer accounts because compromising a single component can affect vast numbers of downstream users, offering a greater return than conventional ransomware. He highlights software bills of materials as valuable records for rapidly locating vulnerable components during incidents such as Log4j, but notes they must be generated and retained continuously because dependency data becomes outdated quickly. Douglas positions platform engineering teams as central to addressing the issue by embedding vulnerability scanning, curated registries, and secure defaults into developer workflows, while CISOs establish broader policy. Although AI may increase both the discovery and insertion of vulnerabilities, he says defensive open-source tools for scanning, tracking, and hardening software have also matured, leaving accountability and ownership as the main barriers to stronger supply chain security.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.