Securing an ATO means proving specific controls are met. Our blog outlines how to use platform capabilities (event logging) and Policy-as-Code (detecting unencrypted secrets) to secure container deployments. https://anchore.com/blog/mapping-container-inspection-to-dow-rmf-controls/

Reporting during a critical event is really about communication. You need to show stakeholders exactly what the exposure looks like right now. Here is a rapid impact assessment plan to generate point in time records quickly. https://anchore.com/blog/zero-day-response-rapid-impact-assessment/

Open source maintainers: drowning in a sea of "good first issues" that never get picked up? You're not alone. It's a contributor time-shortage problem. Our Dir of DevRel @popey.me wondered if an AI could help. So ... https://anchore.com/blog/can-an-llm-really-fix-a-bug-a-start-to-finish-case-study/

Zero-day investigations rely on historical SBOM data. Will you be ready when threats require next-gen SBOMs you never collected? Anchore Enterprise 5.20 = SPDX 3.0 storage now. ➡️ https://anchore.com/blog/anchore-enterprise-is-now-spdx-3-ready/ #SBOM #SupplyChainSecurity

"The format doesn't really matter... It's really about the content." We hosted @stevespringett.bsky.social, Chair of the CycloneDX WG, to discuss why the industry needs to stop fighting format wars and st... https://anchore.com/blog/4-lessons-on-future-of-software-transparency-with-steve-springett/

Keeping up with FedRAMP, CRA, and PCI DSS requirements is burying platform teams. We'll show you how Anchore v6 stops manual CVE chasing and automates vulnerability reporting. Sign up here: https://go.anchore.com/sboms-or-bust-automating-compliance.html

Bloated foundations kill engineering velocity. The Red Hat & Anchore partnership fixes this: 🛡️ SLSA 3 Hardened Images cut out transitive dependencies. 🎯 Anchore's precise feeds eliminate scann... https://anchore.com/blog/how-red-hat-hardened-images-and-anchore-operationalize-trust-and-compliance/

Tired of noisy vulnerability scanners? 🎯 Our own Chadd Owen explains how eliminating heuristic assumptions drastically improves scan accuracy Read more: https://anchore.com/blog/mattermost-container-vulnerability-scanning/

Open source is a gift, but maintenance isn't free. When upstream maintainers move on, the security burden shifts to you. HeroDevs and Anchore discuss how to manage the "Upgrade Hamster Wheel" wi... https://anchore.com/blog/managing-the-eol-trap-why-software-neglect-is-your-biggest-supply-chain-risk/

SBOMs are no longer just an inventory exercise; they are your ticket to global market access under new mandates like NIS2 and SSDF. We're covering how to continuously operate compliance processes that simplify external audits. Regi... https://go.anchore.com/sboms-or-bust-automating-compliance.html

ICYMI - Red Hat announced Fedora Hummingbird during their annual summit. We are proud to see that our OSS tools Syft and Grype are a part of the continuous vulnerability scanning for this new distro. ... https://fedoramagazine.org/fedora-hummingbird-linux-taking-the-hummingbird-model-to-the-full-os/

A CVE scanner won't tell you if a project's maintainer abandoned it 3 years ago. You need to measure project health, not just known vulnerabilities. Learn how to score open source risk: https://anchore.com/blog/threat-hunting-your-open-source-code/

False positives killing your team's productivity? 😵‍💫 Anchore Secure gives you signal, not noise 📡 https://anchore.com/platform/secure/ #SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps

📢 Announcing our partnership with @RedHat to tackle CVE fatigue at source. By analyzing vulnerabilities during the image build, we ensure day-zero accuracy in security feeds and deliver hardened... https://anchore.com/blog/how-red-hat-hardened-images-and-anchore-operationalize-trust-and-compliance/

Most tech debt is invisible until it triggers a P0. In this session, Anchore & HeroDevs dig into why "stable" often means "stale." See the data behind millions of abandoned packages and how to ... https://anchore.com/blog/managing-the-eol-trap-why-software-neglect-is-your-biggest-supply-chain-risk/

The EU CRA is shifting software security from voluntary to mandatory. If your team is manually tracking CVEs, you won't scale. Join Redhat, Bitsea and Anchore to learn how to automate compliance and generate machine-readable evidence. https://go.anchore.com/sboms-or-bust-automating-compliance.html

Shift-left compliance checking ⬅️ Catch violations before deployment, not during audits 🛡️ https://anchore.com/platform/enforce/ #SoftwareSupplyChain #SBOM #CyberSecurity #Compliance

Point-in-time audits fail in Kubernetes because containers are ephemeral. CompOps fixes this blind spot. Anchore continuously maps images by digest, automating real-time CVE tracking & SBOM generation. 👀 R... https://anchore.com/white-papers/making-kubernetes-continuously-audit-ready-with-compops/

FedRAMP compliance in weeks, not months ⚡ Ready-to-deploy policy packs for instant compliance feedback 📋 https://anchore.com/platform/enforce/ #SoftwareSupplyChain #SBOM #CyberSecurity #Compliance

Why guard the castle gates if the threat is already inside? 🏰 Stop focusing solely on the perimeter. It's time to secure the workload itself. Anchore's Chadd Owen breaks down how to protect the software layer. https://anchore.com/blog/anchore-enterprise-powers-dow-zero-trust/ #ZeroTrust #DoD

Still tracking STIG compliance in endless spreadsheets? There's a better, faster way to meet federal security standards. Our Sol. Architect Chadd Owen shows how to automate DoD DevSecOps Reference Design alignment. https://anchore.com/blog/anchore-enterprise-and-the-dod-devsecops-reference-design/

@josh.bressers.name scanned 161 MCP containers. Found 9k vulnerabilities. 263 were critical. "Software ages like milk, not wine." His analysis breaks down what's actually being deployed in the MCP ecosystem and what to do about it. https://anchore.com/blog/analyzing-the-top-mcp-docker-containers/

September 2026 brings mandatory exploit reporting under the new EU CRA. If you are scrambling to figure out exactly what pods are running right now, you need a different approach. Read our white paper: https://anchore.com/blog/compliance-operations-making-kubernetes-audit-ready-by-design/

Point-in-time scanning fails for containers. They are disposable and replaced, not patched in place. Read why shifting from reactive scanning to proactive Policy-as-Code is required to meet DoW RMF requirements. https://anchore.com/blog/mapping-container-inspection-to-dow-rmf-controls/

Verifying software integrity in air-gapped environments is hard. Learn how policy-as-code supports zero-trust and maps to NIST 800-53 in our practical guide: https://anchore.com/wp-content/uploads/2026/04/WP2026_The-Practitioners-Guide-Mapping-Container-Inspection-to-DoW-RMF-Controls.pdf

"What if there's no evidence that that project exists at all on the internet?" asks Dan Nurmi. AI generators hallucinate dependencies, and attackers are name-squatting them. Here's how to catch fake packages in your SBOM. https://anchore.com/blog/threat-hunting-your-open-source-code/

Anchore SBOM Score = CVSS + EPSS + KEV status 📊 Because not all vulnerabilities are created equal ⚠️ https://anchore.com/platform/sbom/ #SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps

Security needs #SBOMs. Devs hate manual tracking that breaks builds. End the friction. Our SBOM Learning Resources Hub has CI/CD guides to get visibility without slowing dev velocity. 👉 https://go.anchore.com/introduction-to-sboms.html?utm_source=sbom-campaign&utm_medium=social&utm_campaign=2026-04

If you are running an air gapped environment, syncing vulnerability feeds during an incident takes a specific process. Check out our zero-day response playbook on updating your GrypeDB and hunting down new threats fast. https://anchore.com/blog/zero-day-response-rapid-impact-assessment/

"Bring Your Own SBOM" sounds simple... Until you try to manage thousands of them 📊 Scale is everything 📈 https://anchore.com/platform/sbom/ #SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps

Supply chain attacks ↗️ 742% in 2023 Your traditional security stack wasn't built for this fight. SBOM-first architecture changes everything ⚡ https://anchore.com/platform/ #SoftwareSupplyChain #SBOM #CyberSecurity

Most of your app is open source. You fuzz the code you wrote, but just cross your fingers on the rest. Zero CVEs doesn't mean a package is safe—it might be abandoned. Time to threat hunt your dependencies. Read more: https://anchore.com/blog/threat-hunting-your-open-source-code/

🎥 Tomorrow! 2026 is the year of FedRAMP 20x, and it's changing everything for cloud-native engineering. 🛠️ We're breaking down: 🔹 Automating OSCAL-compliant logs 🔹 Streaming Key Security Indicators (... https://go.anchore.com/navigating-the-fedramp-pivot.html #GovCloud #FedRAMP #InfoSec #OSCAL

Scale-out architecture for web-scale environments 📈 Because your containers don't wait for security scans ⏱️ https://anchore.com/platform/secure/ #SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps

Stop guessing what "GPL-ish" means. Grant groups licenses by risk so you can approve/deny in seconds. One list, not fifty rules. 👉 https://anchore.com/blog/grants-release-0-3-0-smarter-policies-faster-scans-and-simpler-compliance/ #OpenSource #SupplyChainSecurity #Compliance #DevSecOps

Sometimes you know the vulnerable package version before the security databases update. We put together a rapid incident response plan to search your stored SBOMs for specific packages and get ahead of the scanners. https://anchore.com/blog/zero-day-response-rapid-impact-assessment/

With the EU's Cyber Resilience Act, #SoftwareTransparency isn't optional. It's a global mandate. We're thrilled to announce #SBOM pioneer @allanfriedman.bsky.social is joining the Anchore board to help nav... https://anchore.com/blog/anchore-welcomes-sbom-pioneer-dr-allan-friedman-as-board-advisor/

@josh.bressers.name cuts through the complexity: "Your infrastructure could be a container image... how do you even start to understand what's inside?" Stop guessing. Start using SBOMs. 💡 https://anchore.com/blog/sbom-is-an-investment-in-the-future/

If you write code, buy software, or run apps (so... everyone in 2025), everything you know about software development is changing. The "move fast and break things" era is now "move fast and document everything." What's your compli... https://anchore.com/blog/navigating-the-new-compliance-frontier/

HUGE NEWS! 📣 The "father of SBOM," @allanfriedman.bsky.social, is joining Anchore as a Board Advisor! We sat down with him to discuss the future of #SoftwareSupplyChainSecurity and what comes after SBOM.... https://anchore.com/blog/anchore-welcomes-sbom-pioneer-dr-allan-friedman-as-board-advisor/

CRA demands SBOMs stored for 10 years. PCI-DSS 4 requires scans every 3 months minimum. Compliance isn't annual anymore—it's continuous. @josh.bressers.name explains why your DevOps team already knows how to solve this problem: https://anchore.com/blog/compliance-isnt-an-annual-ritual-anymore/

MCP is having a moment. @josh.bressers.name wanted to know: what are we actually shipping? 9,000 vulns 263 critical findings 36K+ NPM packages Outdated base images Not fear-mongering—just data-driven real... https://anchore.com/blog/analyzing-the-top-mcp-docker-containers/ #MCP #ContainerSecurity

Spending weeks manually matching CVEs to K8s containers? End audit fatigue with CompOps. Anchore automates runtime inventory, drift detection & compliance reporting straight from production. See how: https://anchore.com/white-papers/making-kubernetes-continuously-audit-ready-with-compops/

Stop choosing between machine-readable automated policies & human-readable compliance reports. Anchore 5.26 lets you generate both in a single step! Reduce 'shift-left' friction & satisfy auditors without slowing down engineering. 🚀 https://anchore.com/blog/anchore-enterprise-5-26/

Your scanners are missing the biggest risk in your supply chain. 🔍 Josh Bressers, VP of Security at Anchore, joins us to explain why the most advanced attacks aren't what you should fear—it's the "und... https://techstrong.tv/videos/interviews/the-open-source-trap-why-trust-isnt-a-security-strategy

SBOM-first isn't just a buzzword—it's the architecture that makes continuous security actually possible 🔄 Feel the difference ⚡ https://anchore.com/platform/ #SBOM #CRA #SoftwareSupplyChain #Compliance

"Compliance" often feels like a bottleneck in fast CI/CD pipelines. Our latest blog details how to translate rigorous NIST 800-53 controls into the automated world of containers without slowing down development. https://anchore.com/blog/mapping-container-inspection-to-dow-rmf-controls/

Are you doing reactive, manual SBOM generation, or are you fully automated for continuous SSDF compliance? If you're stuck drowning in JSON sprawl, our resource hub will help. https://go.anchore.com/introduction-to-sboms.html?utm_source=sbom-campaign&utm_medium=social&utm_campaign=2026-04

Security doesn't stop once your container is deployed. Day 2 ops require constant vigilance. 👁️ We break down why continuous monitoring is the true backbone of production security. Read more: https://anchore.com/blog/anchore-enterprise-and-the-dod-devsecops-reference-design/

A container might be compliant at build time but exceed risk thresholds weeks later in production. Policy drift is a major runtime blind spot. See how to automatically flag this drift & generate evidence on de... https://anchore.com/blog/compliance-operations-making-kubernetes-audit-ready-by-design/