Operations | Monitoring | ITSM | DevOps | Cloud

The first two to three hours after a supply chain compromise aren't about remediation – they're about figuring out whether you're affected at all. That requires two things: a feed of compromised packages you can cross-reference against what you're using, and an audit trail showing which developers pulled which packages and when. Teams that can answer "are we affected?" in 30 minutes have that data pre-built into their platform. Teams that don't are still piecing it together at hour three. Protect your supply chain with Cloudsmith.

For a 50-developer team operating at agentic pace, validation-related delivery costs can approach $900K a year.

Code review has always been a time sink. AI just makes the dysfunction undeniable. Luca Rossi, founder of Refactoring.fm and builder of the open source tool Tolaria, has been running one of engineering's most-read newsletters for five years, with over 170,000 subscribers. He's also been doing what a lot of engineering leaders talk about but rarely do: building a real product with AI agents to pressure-test what's actually possible today.

Asking developers to take extra steps to pull securely is a policy that won't hold. The only approach that scales is making the private registry the default – a buffer between the developer and public registries that applies policy automatically at the global level. No extra steps, no security theater, no cognitive overhead at the point of pull. Automation and global policy configuration are what turn good intentions into a default secure posture.

For years, buying software meant trusting the vendor. The Cyber Resilience Act changes that relationship by codifying what vendors must do – auditing dependencies, confirming exploitable vulnerabilities, and enforcing security best practices – as legal obligations, not internal choices. For customers, that means software safety is no longer a matter of brand reputation. For vendors, it means governance gaps that were once internal concerns are now deal blockers.