Malware in open source packages and hijacked maintainer credentials are pushing supply chain risk beyond CVEs. Chainguard's Troy Barker and Qualys's Abhinav Mishra show how hardened images and continuous validation fit together. Join us at ROCon Americas, October 13-15 in Austin, Texas: https://www.qualys.com/rocon/2026/americas Try Qualys ETM free for 30 days: https://www.qualys.com/free-trial-new/enterprise-trurisk-management Shift left has put too much on developers: production blind spots, advisory noise, and compliance work on top of building apps. This Black Hat USA 2026 session shows a different split. Chainguard supplies hardened, low-to-zero CVE container images and language libraries built from verified source, with SBOMs, provenance, and signatures. Qualys validates them continuously in registries, pipelines, and runtime, and defends against what upstream has not fixed yet. Chainguard describes a contractual SLA to fix known exploited vulnerabilities within 24 hours of an upstream fix, critical issues in 7 days, and high, medium, and low in 14. The demo shows TruLens raising a CVE from 8.8 to 10 with threat intelligence, InstaScan flagging an unfixed vulnerability on a Chainguard image the moment it is disclosed with no rescan, TruConfirm validating exploitability with safe payloads, and an AI agent recommending a runtime mitigation. Speakers: Troy Barker, Senior Solutions Engineer, Chainguard, and Abhinav Mishra, Director of Product Management, Qualys Chapters: 0:00 Intro: supply chain and zero-day malware attacks 1:07 Why shift left puts too much on developers 2:29 How Chainguard and Qualys fit together 3:52 Chainguard: the safe source for open source 7:33 Inside the Chainguard Factory 9:14 Hardened images and the 24-hour KEV SLA 10:25 Chainguard Libraries and package malware 11:41 Qualys container security for Chainguard images 12:54 Demo: TruLens threat intelligence and Chainguard advisories 14:10 Demo: InstaScan flags an unfixed CVE with no rescan 16:28 Demo: attack path and TruConfirm exploit validation 17:40 Trust, validate, defend: the full container lifecycle #BlackHat2026 #SupplyChainSecurity #ContainerSecurity

 45      1