Chainguard

Chainguard supplies open source software artifacts that are rebuilt from source, hardened and continuously updated so that customers can reduce vulnerabilities in their software supply chains. Its product lines span Chainguard Containers (minimal, distroless container images with a CVE remediation SLA), Chainguard Libraries (a guarded catalog of language libraries, including Java packages built from source), Chainguard VMs (virtual machine images rebuilt from source daily), Chainguard OS Packages, Chainguard Actions (CI/CD workflows), and Chainguard Agent Skills (a maintained catalog of hardened AI agent skills). All products are produced by what the company calls the Chainguard Factory, an internal build system described as SLSA L3-compliant and, in current messaging, "agentic," which the company says builds, patches, tests and hardens more than 13,000 packages and git repositories [0][3][6].

The company positions its offering around compliance and vulnerability management outcomes: images shipped with SBOMs and provenance attestations, FIPS-validated variants, and solution pages targeting FedRAMP, PCI DSS, CMMC 2.0, SOC 2, CRA, NIS2, HIPAA and Essential Eight requirements, as well as golden image programs and public sector buyers [0][3]. Chainguard also maintains a public documentation and training property, Chainguard Academy, with migration guides, courses, and product changelogs [2], and a public image directory at images.chainguard.dev where free and commercial images are browsable [3].

Chainguard's stated framing has shifted toward AI-era risk: the website argues that AI-accelerated code generation and AI-assisted attacks expand the open source attack surface, and the company has launched Athena, described as an industry coalition to protect open source software from AI attacks [0][7]. Named customers across sources include Anduril, ANZ Bank, Appian, Canva, Checkmarx, Cyera, GitLab, Hewlett Packard Enterprise, MAN Energy Solutions, Oceaneering International, Snap Inc., Snowflake, Univar Solutions, VPBank, Wiz and Booz Allen [5][6][7]."]

Founding story

Chainguard was co-founded by Dan Lorenc (CEO), Matt Moore (CTO) and Ville Aikas; the founding team had worked on open source infrastructure and security projects including Kubernetes, Sigstore and Distroless. In an April 2025 post, CEO Dan Lorenc wrote that the company had been started three years earlier, on the belief that security and innovation should go hand in hand [4][6][7].

Business model

Chainguard sells subscription access to catalogs of hardened open source artifacts (containers, libraries, VMs, OS packages, CI/CD actions, agent skills) to enterprises, with a free tier of selected public images and paid commercial/FIPS tiers; a pricing page and "Get started free" motion are published alongside enterprise sales [0][3]. Revenue is recurring: the company reports ARR figures rather than one-off license sales [6][7].

Recurring subscription revenue (annual recurring revenue) from enterprise customers, including enterprise license agreements such as the one signed with Booz Allen Hamilton; free tiers exist for a subset of images [3][6][7].

Traction

Chainguard reports 424,000+ engineering hours saved and 106,000+ CVEs remediated for customers, a catalog spanning roughly 2,950 projects, 331,754 versions, 657,642 images and over 1.37 billion build manifests, and a 4.7 G2 rating [0][3][4]. Financially, ARR grew from about $5 million to $40 million over fiscal year 2025 (a 7x increase), with a stated plan to exceed $100 million in ARR before the end of fiscal year 2026; container image count grew from 400 to 1,400 over that year and customers for the Containers product surpassed 150 [6][7]. In mid-2024 the company reported a 5x year-over-year increase in customer base and a 175% ARR increase in the first six months of that fiscal year [5].

Latest developments

Recent announcements include the launch of Athena, an industry coalition to protect open source software from AI attacks, with subsequent additions of new coalition members; availability through AWS Security Hub Extended as a supply chain partner; new product lines for OS Packages, Actions and AI Agent Skills; RHEL 9 and RHEL 10 RPM support in Chainguard OS and joining FINOS; partnerships with Upwind and Endor Labs; Gartner Magic Quadrant Leader recognition for Software Supply Chain Security; and an enterprise license agreement with Booz Allen Hamilton [0][6][7].