Skip to content
RockPointCyber
All services

Service 01

Software Supply Chain Modernization

Fix the supply. The backlog takes care of itself.

The problem

Your vulnerability backlog is not a detection problem. It is a sourcing problem. Base images, language packages and CI actions arrive from the public internet with no provenance, and the findings they generate get triaged for years instead of removed once. Most of those findings have no fix available at all, so the work is not risk reduction. It is maintenance of a queue nobody can close.

How we approach it

We change what enters the build rather than adding another tool that reports on what already did. Hardened, continuously rebuilt base images replace general-purpose ones. A curated ingestion path replaces engineers pulling straight from public registries. Behavioral analysis stops a malicious package at install time, before a CVE for it exists, which is the class of control that catches a compromised package on the day it ships rather than on the day it is cataloged.

Around that we build the proof: policy as code at the gates that matter, cryptographic signing and build provenance on every artifact, and admission verification so an unsigned or unattested image cannot reach production. A signature nobody verifies changes nothing, so the verifier is where we start rather than where we stop.

Every gate ships progressively. It observes, then advises, then warns, then blocks, on dates agreed in advance with written criteria for each transition and a named owner for each rollback. A gate that gets switched off during an incident is worse than one that was never installed, because it also spends the credibility of the next one.

What the work includes

  1. 01

    Open source ingestion governance

    A paved road for dependencies: internal proxy, acceptance criteria, minimum release age, install-time blocking for confirmed malware, and an exception path fast enough that teams do not route around it.

  2. 02

    Hardened base image strategy

    Consolidation onto minimal, continuously rebuilt images, with a migration wave plan per runtime, automated migration assistance, and an honest account of what each team gives up.

  3. 03

    Reachability-based prioritization

    Rank findings by whether your code can actually reach them and whether the workload is exposed, so remediation effort follows real risk rather than CVSS.

  4. 04

    Signing, SBOM and provenance

    Keyless signing with no key to leak, SBOM generated at build time rather than reconstructed by scanning, and SLSA-aligned provenance that records what was built from where.

  5. 05

    Admission verification

    Policy at the cluster that verifies the signer identity, the source repository, the release workflow and the provenance content, not merely that something valid signed something.

  6. 06

    Pipeline identity separation

    Distinct build, release and deploy identities with federated short-lived credentials, so a compromised build job cannot publish and a compromised release job cannot deploy.

What you are left holding

  • Current-state supply chain map and measured baseline, generated from Gantry
  • Target architecture with a sequenced migration plan, dated gates and named owners
  • Ingestion policy, admission policy and enforcement schedule, all as reviewed code
  • Signing, SBOM and provenance implementation, verified at admission rather than asserted
  • VEX operating model, so unfixable findings are answered once instead of re-triaged weekly
  • Runbooks, architecture decision records and a ninety-day forward roadmap at handover

What changes

  • Findings removed at the source instead of managed in a queue
  • Every production artifact carries a signature, an SBOM and build provenance
  • A same-day answer to which workloads run a newly disclosed component
  • Delivery lead time held flat while enforcement increases, and measured to prove it
  • Internal engineers who can change, test and roll back every control we built

Where Gantry does the work

This plan is not written, it is generated. Gantry holds the capability model, the framework controls each capability satisfies, the attack techniques and risks each one closes, and the products that genuinely provide them. The engagement itself lives in the graph as well: every task, gate, deliverable and metric target, joined to the controls it satisfies and the risks it reduces. That is why the rollout plan arrives with a compliance crosswalk already computed, and why changing an assumption regenerates the plan rather than starting an argument.

Worked examples

Two rollout plans, published in full.

One measured on our own code, one modeled for an estate. Both use Chainguard hardened images, Socket.dev dependency analysis and Sigstore — Cosign, Fulcio and Rekor — for signing and provenance. We resell none of them. The plans are published because a method you can check is worth more than a method we describe.

Measured · one codebase

We ran this on ourselves before selling it, and published what is done.

A full supply chain modernization of our own monorepo, measured against a working tree rather than estimated: hardened base images, dependency behavior analysis, keyless signing with a public transparency log, and SBOMs scanned at build.

236 → 8
findings, same database version
202
of those had no fix upstream
25 → 784
dependencies chosen, then executed
14
weeks, nothing blocking until week nine

Every figure produced by running the tool named beside it.

Read the measured plan

Modeled · a whole estate

Then we modeled it for an organization that cannot move that fast.

Six months, more than one source control platform, a regulated change process nobody will shorten and delivery velocity on a board report. Two choke points, progressive enforcement with a published way back down, and auditable evidence produced at every stage.

26
weeks, four work streams
63
scheduled tasks, 7 milestones
6
enforcement rungs before anything blocks
142 → 5
target findings per production image

An operating hypothesis, not a delivered engagement — and it says so.

Read the transformation plan

How engagements start

Supply chain diagnostic2 to 3 weeks
Measured baseline, capability map, ranked gaps and a sequenced plan with dated gates. Delivered as a report you can take straight into a budget conversation.
Paved road implementation10 to 16 weeks
We build the ingestion path, the hardened image catalog, the signing pipeline and the admission policy alongside your platform team, then hand over the runbooks and the owners.
Full transformation6 months
The complete program: four work streams, six phases, progressive enforcement and a handover designed so the controls outlive the contract.
Book a scoping callCompare all three services