Ken Malero, Regional Vice President for the Public Sector at ChainGuard, addressed the evolving challenges of compliance in cloud-native environments. With cybersecurity threats increasing in scale and frequency, traditional point-in-time approvals such as Authority to Operate (ATO) are no longer sufficient.
“Just because you got ATO of a system, that's a snapshot in time—you have to stay on it,” Malero emphasized, highlighting the necessity of continuous compliance.
ChainGuard approaches this challenge by securing software at every stage of the supply chain.
“We build everything from source and own the entire supply chain,” he explained. “We started with a whole factory to do secure building of software, from Linux base components to open source projects, all in an automated fashion.”
This rigorous approach ensures tamper-proof delivery of software manifests, combining security with cloud-native practices to improve system reliability and compliance.
“These little pieces in the supply chain have a large impact across the systems that you're building,” Malero noted, reinforcing the importance of end-to-end visibility.
Ken also highlighted the value of local support for the Australian public sector and the potential for collaborative engagement:
“I've got a team here in Australia supporting the public sector. We'd love to have conversations with you,” he said, underscoring the global-local synergy in managing cloud security.
Numbers that tell the story:
ChainGuard builds over 250,000 software images daily, covering approximately 95% of the world's open-source components.
Continuous compliance cycles have been reduced from 6 months → 3 months → 60 days → 30 days, with plans to target 7–15 days.
Automated supply chain management ensures full provenance and secure deployment of every software component.
End-to-end ownership reduces dependency-related vulnerabilities across cloud-native environments.
Continuous monitoring aligns compliance with dynamic threat landscapes, improving resilience and system reliability.
Recommendations
GIW Federal 2025: AI Risks — Safeguarding Services and National Security with James Kay
From Blueprint to Battle: Implementing Cyber Strategies to Stop Threat Actors in Their Tracks
2025 Ransomware Holiday Risk Report
GIW Federal 2025: Securing the supply chain: Managing third-Party risk in government with Rosetta Romano
