Solving the Software Supply Chain — The Somerford Podcast

In this episode, John Dee (Somerford) is joined by Rob Finn (Chainguard) to discuss the critical challenges of securing the software supply chain in modern software development. They explore how open-source vulnerabilities can slow developer velocity, create friction between security and engineering teams, and increase operational and compliance risks. Rob explains Chainguard’s approach of providing “secure by default” images that are rebuilt, tested, and signed at the source, reducing noise from traditional security tools and allowing developers to focus on delivering features safely. The conversation also covers cultural change, adoption challenges, and how organisations can measure tangible ROI through reduced CVEs, improved compliance, and faster deployment.

Looking ahead, the panel reflect on the evolving role of AI and machine learning in supply chain security, the need for continuous monitoring, and the importance of provenance standards like the Salsa framework. Rob emphasises how Chainguard’s approach helps organisations break the “doom cycle” of reactive vulnerability management, streamline workflows, and maintain resilience in an increasingly complex digital environment. Practical advice for security leaders includes starting with base images, measuring impact incrementally, and expanding secure practices gradually to demonstrate clear business value.