Security You Should Know · 2026-07-20 · 18 min
In this episode, Abby Kearns , CEO of ActiveState , explains how her company closes that gap by rebuilding open-source packages from verified sources before they ever reach a developer's pipeline, rather than scanning for problems after the fact. Joining her are Doug Mayer , vp and CISO at WCG , and Howard Holton , former CEO at GigaOM. Want to know: Why is AI increasing exploitability on both the attacker side and the developer side of the open source supply chain? How does a package catalog replace your package manager without slowing developers down or pushing them around the process? What does ActiveState do differently than upstream scanning tools like JFrog Artifactory or Sonatype Nexus? What happens when a developer needs a package that isn't in the catalog yet? How is ActiveState thinking about shadow AI and SBOM coverage beyond language libraries? What upcoming regulatory deadlines, like the EU Cyber Resilience Act, should security teams have on their radar? What happens to open source security when AI produces more CVEs and patches than the maintainers behind these projects can process?
Proving Resilience with Gambit Security75 / 100Elevating the SOC with Prophet Security55 / 100Closing the Configuration Gap with CoreViewSecuring AI Agents with CompFly AIAutomating Offensive Security with XBOW