Post by Calsoft

In March 2026, Trivy — one of the most widely used CI/CD security scanners — was compromised. The tool organizations trusted to catch malicious dependencies became the malicious dependency. CI/CD secrets stolen. Backdoors planted. A self-propagating worm across npm packages. 30% of all data breaches in 2025 involved supply chain components — double the previous year. The attack surface has moved upstream: into the build pipeline, the artifact registry, the identity controls teams assume are locked down. Hyperclapper Snyk scans your code. Aqua scans your containers. Neither governs how your pipeline policies are enforced, how artifact lineage is tracked, or how role-based access is kept consistent across distributed teams. Calsoft helped a global application security provider close exactly that gap — policy-as-code across builds, automated dependency lineage, unified RBAC, and continuous vulnerability correlation — without slowing a single release. Read the full case study → https://lnkd.in/giuJqxGF #DevSecOps #SupplyChainSecurity #CICD #PipelineSecurity #AppSec #SoftwareSupplyChain #Calsoft #PolicyAsCode #ZeroTrust