The safe source for open source — minimal, hardened container images and components
HQ: Kirkland, WA, United States | Founded: 2021 | Employees: ~500 (est.) | Stage: Late Stage VC ($3.5B valuation, April 2025) | Website: https://www.chainguard.dev
Chainguard was founded in October 2021 by five ex-Google engineers: Dan Lorenc (CEO), Matt Moore (CTO), Kim Lewandowski (CPO), Ville Aikas (Distinguished Engineer), and Scott Nichols. The founding team had built Sigstore — the open-source signing and verification standard now used across the industry — at Google, and saw the commercial gap behind the open-source project: enterprises needed not just signed software, but continuously maintained, minimal, vulnerability-free versions of the open-source components they run.
The product is deceptively simple: Chainguard rebuilds popular open-source software (container images, language runtimes, OS packages, and now VMs) from source into 'near-zero-CVE' minimal images, continuously patching them as vulnerabilities are disclosed and shipping provenance (SBOMs, SLSA attestations, Sigstore signatures). For a CISO, the pitch is compliance made real: every container in production can be minimal, attested, and patchable within hours — versus bloated community images with unpatched CVEs and unknown provenance.
Growth followed the log4j/Supply-chain-attack era and accelerated with AI workloads (every AI pipeline is built on the same vulnerable open-source stack). Chainguard grew from 400 to 1,400+ maintained images within a year of its Series D era, landing enterprises across finance, government, and tech. Funding tripled in under a year: $140M Series C at $1.12B (July 2024), then $356M Series D at $3.5B (April 2025), for ~$892M total raised — with a $280M growth financing tranche in October 2025 continuing expansion.
Chainguard turned the industry's most skeptical 'no one pays for open source' assumption into a $3.5B business: enterprises pay because every unpatched CVE in a container image is a compliance failure, and Chainguard rebuilds the entire open-source stack — from 400 to 1,400+ images in a year — as minimal, continuously maintained, provenance-verified packages. Founded by the people who built Sigstore (the open-source signing standard), it tripled valuation in under a year ($1.12B Series C in July 2024 → $3.5B Series D in April 2025) with ~$892M total raised. The bull case: AI workloads make the software supply chain more critical (and more attacked), regulation (SBOMs, fedRAMP-style requirements) mandates provenance, and Chainguard is becoming the default 'safe source.' The bear case: Docker, distroless images, and hardened distros nibble at the edges, and the model depends on continuous investment in rebuilding thousands of upstream packages.
Category: Cybersecurity Startups
Browse: Home | Blog | About | All Startups A-Z | Cybersecurity Startups | View full profile on StartupWiki