Dan Lorenc on Building Chainguard into a $3.5B Open Source Security Company

Rebuilding the Open Source Code the World Runs On

Chainguard's bet is that the open source code nearly every company depends on needs to be rebuilt and sealed, and that this can be a durable business rather than a public good. Dan Lorenc started it in 2021, after a decade at Google, when SolarWinds made the problem urgent. He also argues AI is ending a 30- to 40-year stretch of hand-written software, and that removing the coding bottleneck only moves the constraint downstream.

Takeaways

• Open source runs most software, largely unvetted. About 90 to 95% of daily software, including the code inside ATMs and airplanes, is open source written by strangers. Nation states such as North Korea and Iran deliberately insert bad code into projects that companies run without checking.
• Chainguard rebuilds open source to sell trust. Customers swap their container images and language libraries for Chainguard versions with reported vulnerabilities and CVEs patched, built through its secure build system. It spans 2,000 open source projects and more than 100,000 libraries.
• Scale economics improve margins with every customer. Adding customers does not raise Chainguard's cost, so margins improve and more goes into automation. It began with negative gross margins and now serves more than 600 customers, from 10-person startups to Fortune 5 companies.
• AI moves the bottleneck rather than removing it. Engineers using Cursor and Claude Code spend heavily on tokens, but road maps have not sped up because the constraint moved downstream. Automated factories that go from idea to production come next, making ideas scarce again.
• Productivity gains shrink teams and reshape org charts. If every engineer is 25% more productive, an eight-person team can shrink to four, half from the gain and half from less coordination. Chainguard starts teams of four, citing The Mythical Man-Month and Amazon's two-pizza teams.
• Security teams lag behind AI-assisted engineering. Models are good enough for most engineering teams, and three months behind today becomes three years a year from now. Dan supports giving defenders a two-to-three-month head start, and calls finance teams building untested payroll apps the bigger risk.

How Chainguard Started

1. Dan Lorenc grew up in the 1990s building potato cannons and race cars from magazine plans in his dad's and grandmother's garages.
2. He studied mechanical engineering at MIT until a first programming class using MATLAB showed software was faster than waiting weeks for machine-shop parts.
3. He spent about a decade at Google on infrastructure and open source, and says nobody cared about open source security until the SolarWinds attack.