Anchore

Securing and managing the software supply chain. Proud parent of @SyftProject and @GrypeProject.

[Anchore @anchore]

BIG NEWS! Anchore Enterprise v6 is officially here. We are eliminating the manual "security tax" with a unified SBOM compliance solution. Transform your static SBOMs into a dynamic application-context engine.
Read the launch blog: https://t.co/PINOUMbRLo

#SBOM #AppSec

[Anchore @anchore]

Compliance doesn't have to mean endless spreadsheets. 📉

Steve Springett on machine-readable attestations: "A single attestation can attest to multiple standards simultaneously. This saves a lot of hours!"

See how to automate your evidence: https://t.co/a4GMVuoxxG

[Anchore @anchore]

When auditors ask for compliance reports:

❌ Scramble for weeks gathering data
✅ Log into dashboard with real-time insights

Organizations that chose automation months ago are experiencing this.

Part 2: How to build the audit advantage 👇

🔗: https://t.co/ozHM0pIi7D

[Anchore @anchore]

Fleet-wide policy compliance in 1 query. Get registry → repo → tag → evaluations with a latest flag to filter stale results. Working Python included. Readd the hands-on technical walkthrough: https://t.co/CAJIek3N51

[Anchore @anchore]

Enforce continuous compliance. Supply chain security focus has increased 200%. The EU CRA requires lifecycle accountability. Shift left and centralize component visibility to eliminate bottlenecks, stay compliant by default, and ship secure software fas...
https://t.co/0SexST4xRD

[Anchore @anchore]

A vendor marks a CVE will_not_fix — do you include it in your zero-day sweep or filter it out? Ben Lang's latest on the Anchore Enterprise API covers both, plus the script to automate it. https://t.co/HAPBqrIY5o

[Anchore @anchore]

Getting STIG coverage right on distroless images requires knowing how they are built. We worked directly with @chainguard_dev to validate our image-layer scanning approach against their FIPS image catalog. Get the full technical details: https://t.co/PdgYi2ahSr

[Anchore @anchore]

EU CRA fines: up to €15M or an EU market ban. Two deadlines: Sept 11, 2026 (exploit reporting) and Dec 11, 2027 (SBOMs + Secure-by-Design). Here's the execution checklist → Download now: https://t.co/7NS4plky7B

[Anchore @anchore]

A CVE drops. You need to know which images are affected now, not after analysts finish manual scans. Ben Lang shows 2 Anchore Enterprise API calls + a script for the full blast radius. https://t.co/HAPBqrIY5o

[Anchore @anchore]

"You may rely on an LLM to generate code quickly, but you still need a deterministic way to prove to auditors... the software doesn't contain hidden supply chain risks." CompOps provides that proof before the 2026 EU CRA deadlines. Read the blueprint: 🔗 https://t.co/ktwoV0bZbc

[Anchore @anchore]

"Vulnerable images" and "vulnerable images currently running in production" are different questions. One GraphQL query joins your vuln data with live Kubernetes and ECS inventory to answer the second one. Read our technical blog series to learn more: https://t.co/CAJIek3N51

[Anchore @anchore]

Legacy SCA tools and manual open-source scanners lacked structured visibility into OS vulnerabilities hidden within containers, leaving @Mattermost with security blind spots. See how they closed the gap using Anchore Enterprise for centralized, deep co... https://t.co/4XZiOZhqUq

[Anchore @anchore]

For #software to be built, deployed, and used by the warfighter, it must achieve ATO and be built on a platform that meets strict DoD standards. Learn how Anchore and Sigma Defense teamed up to help the US Navy in this case study 👉 https://t.co/YryCk5RozQ

[Anchore @anchore]

The #xz (CVE-2024-3094) is a perfect example of a #supplychainattack. We have a short explainer on the blog on how our Anchore Enterprise customers and OSS #Syft users can immediately report on it. https://t.co/mkCUEv3kZx

[Anchore @anchore]

LLMs write code fast. But speed without proof is just risk.
CompOps gives you the proof auditors demand. Download our whitepaper for securing your AI-driven software supply chain: https://t.co/efzobTncxj

[Anchore @anchore]

Sept 11, 2026: EU CRA mandates 24-hour active exploit reporting. Do you have KEV feeds integrated, alerts automated, and notification templates ready? 6-phase checklist for Engineering, SecOps & GRC → Download now: https://t.co/7NS4plky7B

[Anchore @anchore]

Before you query, introspect. The Anchore Enterprise GraphQL endpoint returns its full schema — 16 query types, filters, fields — straight from your deployment. Read more in part 4 of our blog series: https://t.co/CAJIek3N51

[Anchore @anchore]

Pursuing an ATO or FedRAMP using @chainguard_dev images? We worked with Chainguard so Anchore Enterprise now supports STIG compliance checks for both shell-based and fully distroless variants, giving reviewers the audit trail they need. https://t.co/PdgYi2ahSr

[Anchore @anchore]

Remember Log4Shell? Security teams spent days hunting for every vulnerability instance. ➡️ Go from reactive chaos to proactive precision with SBOMs. Watch the webinar to see how: https://t.co/R4JINqYeis #SBOM #Security #AppSec

[Anchore @anchore]

Mitigate vulnerability noise. EU CRA incident reporting starts in 2026. You can't report what you cannot see. Stop manual triage & deploy continuous monitoring to accelerate remediation. Enforce policy gates to stay compliant by default & ship secure so... https://t.co/0SexST4xRD

[Anchore @anchore]

How do you get container security alerts into a SIEM? Use the transform-and-forward pattern. Receive an Anchore event, enrich it with API vulnerability context, and push it. See how to format a normalized event in Python: https://t.co/OVlQANXMCv