Software Supply Chain Security for Complex Stacks

Kusari is software supply chain security for complex stacks, built for the challenges of regulated teams. It builds one dependency graph from your actual builds, across every repo, language, and source control platform. It catches risky dependencies before they merge, validates fixes that are re-checked against your build, and attaches evidence your auditor can verify.

Regulated companies rarely run simple software. Acquisitions, cloud migrations, and years of custom tooling leave monorepos, mixed languages, and more than one source control platform, but most security tools were built for cleaner setups. Kusari generates SBOMs and builds the dependency graph from your actual builds, so it runs on the stack you have. Every finding and fix ships with evidence in open formats an auditor can check. The founders ran software at Bridgewater and Citi, then wrote the standards your auditors now cite.

It's the case we built for. Kusari speaks one language, the SBOM, so supporting a new build system means writing an SBOM generator for it with Waybill, the open source tool Mike built and maintains. We've done it for monorepos, mixed-language builds, and FedRAMP environments. We won't claim every build system works on day one. Bring us a public repo and we'll show you on your setup in a few days or weeks.

Those tools tell you a vulnerability exists. On a complex stack, they often miss transitive dependencies or can't resolve the build at all, so the gaps look like clean results. Kusari takes in what they find, puts it in one graph built from your own builds, then runs reachability and generates fixes with evidence. Teams usually start by running both side by side.

Reachability analysis asks whether the vulnerable code in a dependency can actually be called from your application. Kusari runs it on a graph verified at source, so the answer reflects your real software. At a 6,000-seat health insurer, that removed 90% of vulnerability noise before anyone had to triage it.

Kusari confirms the vulnerability is real and reachable, finds the version that actually fixes it, and re-checks the change against your build before you see it. Straightforward fixes arrive as a pull request for a developer to approve. Riskier changes get flagged for a human, with the fix path laid out. Every change goes through your team's normal review.

Kusari checks every pull request, from a developer or a coding agent, against the full dependency graph, so risky dependencies get caught before they merge. Once current issues are fixed, guardrails keep the same class of issue from coming back: unsigned code doesn't merge and unattested artifacts don't deploy. SLSA, which we maintain, gives your auditor evidence that it's working.

You ask Kusari whether you're exposed, and the graph answers: which services include the component, whether anything can reach the vulnerable code, and who owns the fix. As one security architecture leader put it: "A zero day hits, my CISO comes to me that morning and says, are we exposed, and I already have the answer for him."

SBOMs and attestations in CycloneDX, SPDX, OpenVEX, and SLSA provenance, tied to your builds. Because the formats are open, the evidence goes straight to your auditor, regulator, or customer. It maps to the rules each industry answers to: DORA, NYDFS Part 500, PCI DSS 4.x, and FFIEC in financial services; NYDFS Part 500, state insurance data security laws, and HIPAA for insurers and payers; EU CRA, FedRAMP, SOC 2, and FDA 524B for regulated SaaS. It also covers customers who ask for an SBOM before they sign.

Tim Miller, Michael Lieberman, and Parth Patel. Tim and Mike ran software at Bridgewater and Citi, automating the kind of custom stacks regulated companies run today. The team built GUAC with Google, now under OpenSSF, and helped bring SLSA from Google into open source. Mike still maintains SLSA.