Chainguard Raises $356M to Protect Open Source Supply Chain

A supply chain security startup led by an ex-Google Cloud engineer raised $356 million to mitigate accidental and malicious vulnerabilities in widely used software components.

See Also: Accelerating defense missions with a global data mesh

The Series D funding will help Seattle-area Chainguard expand its product offerings from protecting container images to safeguarding virtual machines and language-specific libraries to better cover almost all enterprise-used open-source code, according to co-founder and CEO Dan Lorenc. He said rebuilding open source from the ground up will help Chainguard address vulnerabilities that other vendors overlook.

“You raise rounds when you can, when the market supports it and before you need to hopefully,” Lorenc told Information Security Media Group. “So, I don’t think we’ve spent any of the last round. It’s just a chance to raise another round now at a great price driven by all of that customer momentum.”

How Rapid AI Adoption Complicates Open-Source Security

Chainguard, founded in 2021, employs 402 people and has raised $612 million across five rounds of outside funding. Prior to founding Chainguard, Lorenc spent nine years working on the infrastructure behind the Google Cloud platform. The latest funding comes just nine months after Chainguard closed a $140 million Series C funding round, with the company tripling its valuation to $3.5 billion in that time (see: Chainguard Raises $140M to Drive AI Support, Global Growth).

Open source powers everything from flight systems to banking infrastructure, but it is inherently risky since anyone – benign or malicious – can contribute code, Lorenc said. By creating secure versions of commonly used packages and maintaining them internally, Chainguard ensures that these components are vetted, verified and inherently protected before they’re ever deployed in enterprise environments.

“We’re rebuilding all of that open source from scratch ourselves and dealing with vulnerabilities at that core level,” he said. “That’s both accidental vulnerabilities, things like log4j, log4shell and also malicious ones. The reason it works, the reason it’s free, the reason people can rely on it is anybody on the internet can contribute to it. The terrifying part there is not everyone on the internet is a nice person.”

Unlike traditional open-source components that experience slower uptake in regulated environments, new AI frameworks and libraries are being adopted at lightning speed, Lorenc said. The pace of AI adoption in regulated industries is accelerating faster than security teams can keep up, meaning that security requirements are kicking in before projects are mature enough to meet them, according to Lorenc.

“What we’ve seen actually is a huge push toward all these new AI frameworks and libraries, and the adoption of that inside of companies is going way faster than I would have expected,” Lorenc said. “So, open source is continuing to move faster and accelerate, both in all the new stuff getting created and the pace at which it’s getting adopted inside of large regulated industries.”

From Containers to Virtual Machines, Language Libraries

VMs are critical because every container runs on one, and many apps still rely on VMs for performance-intensive workloads. And programming libraries present unique risks, as they’re often pulled from anonymous sources and are a prime target for malware injection. This three-pronged strategy helps Chainguard protect the vast majority of open-source software used in enterprise environments, he said.

“You can’t be the safe source for open source unless you have all open source,” Lorenc said. “Containers are one amazing way people get open source today. They’re a standard unit. Everyone is running them. Container rollouts are happening across the entire industry. So we started there, and it’s a great form factor, but it’s not the only way people consume open source with virtual machine images.”

Government systems are particularly challenging because open-source technology is often deployed in air-gapped environments with no internet access. This contrasts with the frequent patching cycles common in commercial firms that are always connected. Despite this, he sees enormous potential, particularly as governments demand higher assurances for the software running in critical infrastructure.

“Some of those requirements change a little bit,” Lorenc said. “The security standards are the same or even stricter for a lot of these public sector environments, and that makes sense. All of the code getting deployed into our most sensitive government systems needs to be as secure as possible.”

Chainguard intends to grow annual recurring revenue from $40 million in 2024 to $100 million in 2025, and has specific growth goals for its traditional enterprise business as well as its emerging public sector and international businesses. Lorenc said Chainguard’s core value proposition resonates everywhere because the same code is being used by developers across the world.

“Open source is used everywhere,” Lorenc said. “It’s not a single country, single region thing. Open source is used all over the world. That’s one of the key principles of open source. Anyone has to be able to use this for any reason. So, it’s not just a U.S. problem. Everyone is building on open source, cloud migrations are happening quickly across the world and those same security problems affect everyone.”