Anchore

Anchore is a software composition analysis (SCA) platform that helps organizations ensure the security and compliance of their software supply chains. Anchore uses software bills of materials (SBOMs) to create and track detailed records of software components and dependencies from development through deployment. This end-to-end visibility lets companies spot known vulnerabilities, stay in compliance with industry standards and regulations, and lower the risk of security problems.

Among Anchore's features:

• Visibility: Create and track SBOMs throughout the software development lifecycle (SDLC).
• Inspection: Continuously scan for known and unknown vulnerabilities and security problems in software components.
• Policy Enforcement: Pass-fail against compliance standards using pre-built policy packs for standards like NIST, FedRAMP and DISA.
• Remediation: Alert teams with recommended fixes through integrations with GitHub, GitLab, Jira and Slack.
• Reporting: Customizable reports on compliance, vulnerabilities and security status.

Anchore can help with a shift-left approach to DevSecOps, plugging security checks into the tools developers already use. That can streamline developer workflows, for example by using recommended fixes to speed remediation. The company also offers a path to regulatory compliance with pre-built policy packs and custom policy rules to accommodate internal or customer needs.

Companies using Anchore include the US Department of Defense, Fortune 500 companies and industry players like NVIDIA, Cisco and eBay. Its products work in both enterprise and federal environments, with features customized for the different needs of each market.

For the public sector, Anchore automates compliance checks for government security standards like DoD, DISA STIG, FedRAMP, NIST and CIS Benchmarks. The product is designed to work in air-gapped environments and meets US Federal security requirements.

Anchore's SBOM-based approach offers a solid foundation for cloud-native apps and for managing software supply chain risk. By building Anchore into their development processes, companies can maintain continuous visibility, security and compliance to ensure the integrity of their software supply chains.

Published on August 3, 2024