Free tools Windows power users keep installed
One-click scans. No signup required.
A Cloudsmith survey of 400 platform and security engineers in the United States and United Kingdom found that 73% were either only moderately confident or not confident in their existing tools’ ability to prevent software supply chain attacks. That figure combines two different answers: 58% were moderately confident and 15% were not confident. It does not mean that 73% had no confidence at all.
What the survey measured
Cloudsmith sponsored the survey, and DevOps.com reported its findings on September 28, 2026. The respondents were 400 platform and security engineers in the U.S. and U.K.; the figures describe those respondents, not all companies or security teams. Cloudsmith sells artifact management software, so the findings are relevant to the field but are not independent product benchmarking. DevOps.com’s report presents respondents’ confidence, incident response, software bills of materials (SBOMs), audit readiness, and use of AI coding tools.
The article’s 73% confidence figure should also be kept separate from a different 73% in Cloudsmith’s official report page. That page says 73% trusted their tools to stop an install-time attack before an advisory exists—a narrower, distinct question. Cloudsmith’s report page also focuses on controls applied before package ingestion.
As an Amazon Associate I earn from qualifying purchases.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhere respondents saw gaps
Confidence in prevention tools
In the DevOps.com coverage, 58% of respondents were moderately confident and 15% were not confident that their artifact management tools could prevent software supply chain attacks. The remaining respondents are not characterized by those two figures, so they should not be treated as uniformly confident.
Incident response still often needs people
Forty-eight percent said detecting an intrusion still required manual effort to quarantine or resolve it. By contrast, 37% said they could automatically identify, block, and trace an intrusion within minutes. These are different response descriptions; the figures do not establish how the other respondents handled incidents.
#1 Best Overall
SBOMs are common, but automated enforcement is not
Ninety-five percent said their organizations generated SBOM data, but just 25% integrated and automated SBOM verification into security gatekeeping. The report says 75% used SBOM data for ad hoc compliance only. Generating an inventory can help establish what software is present; it is not the same as checking that inventory against policy and blocking or quarantining a risky artifact.
Audit readiness and changing approaches
Only 27% were very confident their organization could pass an unexpected audit. Separately, 65% were investigating a different compliance approach (45%) or evaluating a security framework (25%). The coverage does not say whether those two groups overlap, so the percentages should not be added together to estimate a distinct total.
AI coding tools and build provenance
Sixty-one percent were at least moderately confident that AI coding tools were not adding vulnerabilities. Thirty-two percent scanned AI models for specialized threats, while 41% scanned for basic integrity indicators such as checksums or provenance. Separately, 50% relied on provenance or attestation data to validate software builds. Confidence, specialized threat scanning, basic integrity checks, and build validation are different measures; none alone demonstrates that AI-generated code or a build is safe.
What earlier controls can add
Cloudsmith’s report page frames the issue around stopping install-time attacks before an advisory exists. It reports that 38% of respondents scanned packages before ingestion and 24% automatically enforced cooldown policies. Ingestion screening checks a package before it enters an organization’s managed environment; a cooldown policy delays use of a newly published package for a defined period. These approaches can complement build-time provenance checks and post-deployment monitoring, rather than replacing them.
Rank #3
The figures come from the survey sponsor’s report and describe reported practices, not a controlled comparison of security outcomes. They do not prove that a specific tool or control prevents attacks in every environment. A useful implementation question is whether a control can act at the point a team needs it: flagging risk is different from automatically blocking or quarantining an artifact, and a control is more useful operationally when responders can trace which builds and dependencies were affected.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to interpret the findings for your team
The survey points to a practical distinction between having security data and using it to make enforceable decisions. A team reviewing its own supply chain can assess its controls against the same stages highlighted by the findings:
- Before ingestion: Determine whether packages are screened before they enter internal repositories, and whether policy can block or quarantine them.
- At build time: Verify provenance or attestations and retain enough information to trace an artifact back to its source and build process.
- For SBOMs: Check whether verification is automated in release or security gates, rather than limited to generating inventories for occasional compliance requests.
- During response: Establish whether a detected intrusion can be identified, blocked, quarantined, and traced quickly, or whether those steps depend on manual work.
- For auditability: Confirm that evidence of policy decisions, artifact provenance, and remediation can be retrieved when needed.
Cloudsmith’s documentation describes its own platform as offering package signing, SBOM generation, artifact risk scanning, and policy-driven blocking, quarantine, or tagging. Those are vendor-described capabilities, not independently verified outcomes. Cloudsmith’s supply chain security documentation is a reference for those product claims, not comparative proof that one product resolves the survey’s gaps.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
