Software supply chain

Software supply chain is the category that secures what goes into a build: the packages your team and your coding agents pull, the registries they come from, and the firmware blobs you never compiled.

This index maps every company whose primary product secures that chain: SBOM generation and management, trusted artifact rebuilding, registry and pipeline policy gates, behavioral malicious-package detection, firmware and binary analysis, and patch backporting onto the versions you already run.

Public mega-cap SCA suites stay off this list. Every entry carries a 2024 to 2026 proof-of-life signal recorded with a source link, and membership is taxonomy from the research pass.

The products here cluster into five shapes. Trusted-artifact platforms rebuild open source from public source and attach SBOMs and attestations, and artifact registries enforce policy on what may be pulled and published.

SBOM platforms generate bills of materials, treat them as an operational dataset, and extend them to firmware and model ingredients.

Behavioral SCA inspects what a dependency actually does and blocks malicious packages at install instead of waiting for a CVE to land; reachability filters then cut the remaining noise.

Firmware and binary analysis unpacks what device vendors actually shipped: components, licenses, and vulnerabilities that never appear in an application scan.

Patch backporting moves the upstream fix onto the version you already run, including end-of-life versions, so scanners see a fixed coordinate. Several of the twelve entries name an AI-specific surface, from agent-pulled packages to AIBOMs.

AppSec and product-security teams shortlisting SBOM, SCA, and artifact-control vendors, device makers who need a living SBOM for the products they ship, and investors mapping how AI-written code is changing what supply-chain products must do.

Included only when a live company has primary category supply-chain. Application scanners, cloud posture suites, and public mega-cap SCA platforms live in their own categories or off this directory.

Inclusion is category-based and verification-gated, not paid placement and not an endorsement of outcomes.

Listings are the full live catalog slice for this primary category, sorted alphabetically by name. This is not a scored quality ranking and there is no paid placement. Aevral is a disclosed house listing under the same rules (live, no pin). See /transparency.