Security Hub Extended adds Supply Chain Security as its tenth category

<p>Since February, we’ve grown <span class="LinkEnhancement"><a class="Link" href="https://aws.amazon.com/security-hub" target="_blank" rel="noopener" data-cms-ai="0">AWS Security Hub Extended</a></span> from 14 curated partners across 9 categories to 23 partners across 10. At Black Hat this month, 14 of those partners were at the <span class="LinkEnhancement"><a class="Link" href="https://aws.amazon.com" target="_blank" rel="noopener" data-cms-ai="0">Amazon Web Services (AWS)</a></span> booth demoing live. Four of those partners delivered theater talks and ten were featured on SecurityLive streaming. We hosted a partner reception that brought our leadership together with partner executives to plan what comes next. These are companies investing real engineering and real go-to-market (GTM) alongside us, and increasingly with each other, because the model resonates with the customers they’re talking to every day. The most common question we heard at the booth was when Supply Chain Security was coming.</p>

<p>It’s here. And that’s the thing I want to spend the most time on today, because it’s the category customers keep asking us about.</p>

<h2>Supply Chain Security: The category customers have been asking for</h2>

</div>

<p>Software supply chain risk has moved from a security-team concern to a board-level conversation. SolarWinds showed what happens when a build system is compromised. Log4j showed what a single transitive dependency vulnerability can do at global scale. The xz utils backdoor showed the patience of a maintainer-compromise attack executed over years. Each demonstrated a different dimension of the same problem, and the pace is accelerating. Attackers know that a fast way into an enterprise is through the open source packages that enterprise unknowingly trust.</p>

<p>Every customer I talked to at Black Hat had this on their risk register. Most still hadn’t operationalized a solution, because doing so meant a standalone deployment, a new contract, a new console, and integration work their security team couldn’t prioritize. That’s the friction we aim to remove.</p>

<p>Security Hub Extended now offers Supply Chain Security with Chainguard and Socket as the curated partners. Supply Chain Security uses the same model as everything else in Extended. Every offering has pay-as-you-go pricing, one bill, no required long-term commitment. For enterprises that prefer to continue using the procurement process they always have, Security Hub Extended Private Offers are also available. These are committed term agreements with deeper discounts, the ability to aggregate spend across partners on a single AWS bill, and both monthly and annual payment options throughout the term. You pick the path that fits how you buy.</p>

<h3>What Chainguard does</h3>

</div>

<p>Chainguard gives you open source dependencies rebuilt from source in a hardened, verified build process, so what enters your environment is malware-resistant and provenance-backed. Their <span class="LinkEnhancement"><a class="Link" href="https://www.chainguard.dev/unchained/malware-resistant-python-without-the-guesswork" target="_blank" rel="noopener" data-cms-ai="0">research shows</a></span> that rebuilding from source would have stopped 98% of known malicious packages from ever reaching production. If you can’t verify the source, it never appears in the Chainguard repository. That’s the filter between the public registry and your developers.</p>

<h3>What Socket does</h3>

</div>

<p>Socket analyzes the actual behavior of open source packages to block malicious dependencies at the time of install. Not after a Common Vulnerability and Exposures (CVE) is published days or weeks later. At the moment the package tries to land in your environment, Socket flags it based on what it does, not what a database says about it. Its reachability analysis then tells you which vulnerabilities are exploitable from your code instead of drowning your team in noise. You pay for the distinct packages you check, not for how often your builds run.</p>

<h3>Why they work together</h3>

</div>

<p>Together, Chainguard and Socket cover the two questions that matter:</p>

<li>Can I trust what I’m pulling in?</li>

<li>Can I stop malicious components before they get built into my applications?</li>

</ul>

<p>Chainguard helps secure the foundation your code is built on. Socket secures the packages you pull into it. Both help protect your software supply chain regardless of