Inspired with Alexa von Tobel
00:11:58 · Alexa von Tobel
[00:11:58] S1: We always say we like businesses that get bigger... That as they get bigger, they get better. Yes. Right. And this is a perfect example of one. Quickly, let's just, like, give a real life example of what a customer... Just, like, give us an example of a customer, what they come to Chainguard for, what they get, how you safe proof it, and just kind of walk us through a real life example.
00:12:19 · Dan Lorenc
[00:12:19] S0: Yep. Our customers, I think we have a little over 600 of them now, and they span from, you know, 10 person startups to, you know, Fortune five companies. We're running inside of defense systems in outer space, kind of in all of these embedded systems too in places I didn't even know open source was used that prevalently. Oh, it's kinda scary at the end of the day, many places the software is deployed. But, yeah, at the end of the day, people are used to downloading software from this fragmented collection of, ecosystems and hubs and websites that kind of aggregate and store open source. And so when a customer gets it from us, they just kind of do a one for one swap. They change the version they were getting, to the version they get from us. That could be a container image, a programming language library if you're, you know, writing Python or JavaScript or something like that, and swap it out. We go through that software, and we patch all of the vulnerabilities that get reported. We fix all of the CVEs that show up in security scanners, and then run that through our secure build system and hand that to our customers. So for the most part, it's just kinda changing out what you were getting with a better version of it.
00:13:23 · Alexa von Tobel
[00:13:23] S1: Okay, Dan. I'm gonna ask a really dumb question just because I want everybody out there to actually learn and understand how this works. How do you get it clean? How do you... And and to your point, you started this saying, literally, you have countries that we are at war with on purpose injecting problematic software into these places. And you just said some of the software is going into places like outer space, like places where we really don't want there to be a mistake. Yeah. So it's pretty critical that this software is safe and, you know, not laden with a bunch of problematic code. How do you how do you safeguard it?
00:14:02 · Dan Lorenc
[00:14:02] S0: Yeah. We have a lot of automation for this, and it's a business of edge cases. So there's no single answer. Right? But we have tons and tons of automation, and we keep building more and more automation to do this. And then we also have a team of people manually doing these checks and work and patching and builds, for the areas our automation can't handle. And we keep giving them more and more work to do as we keep growing and scaling all the software we have, and then we also keep giving them better and better tools to do that work in. You know? But it starts at the very beginning. It starts by, you know, getting the source code, the very rawest source code, and the source code for all of the dependencies of that kind of thing and checking it, running it through process, patching everything that we find in it after we scan it, getting that built, figuring out how to build it, and then reassembling everything back together again in the end and handing that to our customers. We call that part of it the software factory that we built, and it's a lot of work every time we have to hook that up to the automation and hook that up into our factory so the automation can take over. And then there's automation that finds places the automation can fix something and escalates that to the team, and the team, you know, manually does that work, but then figures out how the automation could handle that kind of thing in the future.
00:15:04 · Alexa von Tobel, Dan Lorenc
[00:15:04] S1: That's amazing. Dan, over the last couple of years, you guys have expanded beyond containers into libraries, OS packages, and more recently into workflows and agent related products just announced this year in 2026. How have you thought about your own product expansion? And then let's get... Let's touch on agentic workflows and Yeah. What that's gonna look like. [00:15:25] S0: We're we're fourteen minutes in, and we're finally talking about AI. Yeah. That's kinda correct. [00:15:29] S1: Hey. By the way, you're welcome. Yeah. Yeah.
00:15:33 · Dan Lorenc
[00:15:33] S0: I mean, it's probably the most exciting and scariest time to be in software engineering in, you know, the history. It's... You know, software engineers mostly been the same for the last thirty or forty years. Different programming languages, different tools. But at the end of the day, people, you know, still been writing this stuff by hand. The tools have gotten a little bit better, but, you know, there's been no massive step function increase in productivity since the first programming languages came out. And now all of sudden, that is getting flipped on its head, and the entire way we build software and products and ship features and road maps and where is your mode and differentiation and all of that is just kind of thrown up in the air, and everyone's trying to figure it out all at the same time. But, yeah, we've been able to leverage a lot of this stuff over the past couple... The past, say, eighteen months, really, to accelerate how we're shipping code, letting us do more things safely and securely. So, yeah, the business we started with container images, and we've, you know, we spent a whole year trying to use AI automated, and nothing worked. And then all of sudden, like, overnight, the models and the harnesses and everything got better. And we've been able to, you know, use AI to ship... To add more things to the catalog even faster and maintain that software in the catalog even faster. So, yeah, we've expanded. We're trying to to secure all open source out there and containers where we started are just one small portion of that. It's one of these things where the... We would not have been able to build these products or this business the way we were trying to if these tools hadn't gotten there. And, thankfully, they kind of did it the exact right time for us.