Cloudsmith

Cloudsmith operates a cloud-native, fully managed artifact repository platform (packages, containers, and other build artifacts) that has increasingly layered software-supply-chain security controls on top of its core package-hosting function. Its security capabilities include deep SBOM (software bill of materials) inspection to flag unsafe transitive dependencies or non-compliant licenses, automatic quarantine ("cool-down") periods that hold newly published dependencies until they’ve been vetted by the broader security community, and exploitability-based prioritization that uses EPSS scoring to focus remediation on vulnerabilities that are actually likely to be exploited rather than every CVE regardless of real-world risk.

Founded in 2016 by Lee Skillen and Alan Carson, Cloudsmith is headquartered in Belfast, Northern Ireland. The company has raised substantial venture funding, including a $23 million Series B and, more recently, a $72 million Series C led by TCV with participation from Insight Partners, explicitly positioned around securing the software supply chain, including AI-generated code and dependencies.

Cloudsmith’s core product remains a general-purpose artifact management platform rather than a dedicated, single-purpose security tool, so its supply-chain-security capabilities function as an increasingly prominent layer on top of an infrastructure product rather than the company’s sole focus. That said, software supply-chain attacks (malicious packages, dependency confusion, compromised build pipelines) are a well-documented and growing threat category, and Cloudsmith’s SBOM- and EPSS-based controls are a substantive, purpose-built response to it rather than a superficial add-on.