# AI turns software supply chain security into a continuous engineering discipline | LinearB Blog

> Chainguard CEO Dan Lorenc reveals how AI is turning software supply chain security into a continuous engineering discipline, moving from restrictive guardrails to frictionless "guide rails" to handle a 500x increase in code volume.

_This is a markdown rendering of a live HTML page on linearb.io, generated for AI/LLM consumption — it is not a markdown-only site. To get the full HTML page instead, request this URL with an explicit `Accept: text/html` header (no wildcard, no markdown preference)._


```json
{
  "@context": "https://schema.org",
  "@type": "BreadcrumbList",
  "itemListElement": [
    {
      "@type": "ListItem",
      "position": 1,
      "name": "Home",
      "item": "https://linearb.io/"
    },
    {
      "@type": "ListItem",
      "position": 2,
      "name": "Blog",
      "item": "https://linearb.io/blog"
    },
    {
      "@type": "ListItem",
      "position": 3,
      "name": "AI turns software supply chain security into a continuous engineering discipline",
      "item": "https://linearb.io/blog/dan-lorenc-chainguard-ai-supply-chain-security-guide-rails"
    }
  ]
}
```

[Home](https://linearb.io/)

/

[Blog](https://linearb.io/blog)

/

AI turns software supply chain security into a continuous engineering discipline

# AI turns software supply chain security into a continuous engineering discipline

![Photo of Andrew Zigler](https://assets.linearb.io/image/upload/c_limit,w_2560/f_auto/q_auto/v1/Headshot3_d7231cbda7?_a=BAVMn6ID0)

By [Andrew Zigler](https://linearb.io/blog/dan-lorenc-chainguard-ai-supply-chain-security-guide-rails#andrew-zigler)

|

April 1, 2026

![Blog_Software_supply_chain_security_2400x1256_4537b892c4](https://assets.linearb.io/image/upload/c_limit,w_2560/f_auto/q_auto/v1/Blog_Software_supply_chain_security_2400x1256_4537b892c4?_a=BAVMn6ID0)

The software supply chain has always been an iceberg, and most of what powers modern applications remains invisible, buried deep in dependency layers that few teams directly observe. But as AI-driven engineering accelerates code production, that hidden foundation is accumulating security debt at an unprecedented rate.

[Dan Lorenc](https://linearb.io/dev-interrupted/podcast/dan-lorenc-chainguard-agentic-supply-chain-security), co-founder and CEO of Chainguard, frames the challenge starkly. Faster iteration and higher code volume are already stressing existing verification, release, and supply chain assurance practices. The issue is not whether AI-generated code can be trusted in isolation. The real issue is whether organizations can control how that code is validated and allowed to reach production.

## The bifurcation of the software stack

Lorenc predicts a [bifurcation in the software stack](https://linearb.io/blog/how-agentic-ai-will-disrupt-your-software-delivery-lifecycle). People are going to keep using battle-tested pieces of software at the foundation. Components like web servers and databases are too critical and too complex to replace with generated alternatives. In these cases, Lorenc argues that the industry is better off if everyone points their tokens at one solution to make it better over time, rather than everyone pointing their tokens at their own fragmented solutions.

However, the middle layer, the integration glue, middleware, and client libraries, may increasingly be generated or maintained internally through agentic development. Lorenc anticipates this middle section getting hollowed out a bit as agents become better at handling the "glue" that holds applications together.

This shift does not eliminate supply chain risk; it transforms it. Organizations must now account for incident response across both traditional dependencies and internally generated components. Supply chain security becomes an ongoing organizational capability rather than a one-time procurement decision. It requires the stewardship of widely deployed but lightly maintained components and continuous risk assessment.

The implication for engineering leaders is clear. Supply chain security can no longer be treated as a static concern. As agents reshape what gets built internally versus consumed externally, teams need visibility, governance, and rapid response capabilities that span both traditional open source dependencies and the expanding surface area of AI-generated integration code.

## Trustworthy CI/CD lets teams ship at scale

When code volume increases by an order of magnitude overnight, the bottleneck shifts from writing to shipping. AI-enabled development only scales when [CI/CD systems](https://linearb.io/platform/programmable-workflows/features) provide dependable tests, automated deployment, and clear signals that teams can trust.

Lorenc describes a progression from loose guardrails to tight guide rails, creating a system where repeated checks and constrained pathways lead to eventual determinism for both human and machine-generated changes. He uses the metaphor of bowling with bumpers. A single ball bounces predictably and reaches the pins. But if you throw a hundred balls down the lane simultaneously, chaos ensues unless those bumpers are precisely calibrated.

Lorenc sees this calibration as the future role of engineers, getting those gates rock solid, ensuring all intent is captured, and validating performance so teams can deploy with confidence.

Flaky tests, fragile deployments, and low release confidence become the true bottleneck when parallelized coding agents dramatically increase output. If a team is scared to deploy on a Friday because half the deployments crash, generating 500 times more code does not help. It simply creates 500 times more risk sitting in a queue.

Lorenc recommends prioritizing strong deployment pipelines even in regulated environments that cannot yet fully adopt AI. Those systems become the foundation for later automation. The engineer's role evolves from manually carrying every change across the finish line to encoding intent, quality thresholds, and operational safety into the delivery system itself.

For teams with [rock-solid pipelines](https://linearb.io/blog/ai-driven-software-development-shift-speed-to-velocity) where green checks mean production-ready code, agents become true force multipliers. The code quality matters less than the system's ability to catch problems before they reach users.

## Google shows AI can strengthen open source despite the spam

AI is both a burden and an accelerator for open source maintainers. On one hand, low-quality issue and vulnerability spam is increasing. Daniel Stenberg of the cURL project has publicly complained about ChatGPT-generated security reports flooding his vulnerability disclosure process with garbage, making it harder to find real vulnerabilities.

On the other hand, automated analysis and remediation are improving. Google's Deep Sleep research recently found genuine zero-day vulnerabilities in open source projects that no security tools had previously detected, disclosed them responsibly, and got them fixed before exploitation.

Lorenc predicts a near-term split where some projects reject AI-mediated contribution flows entirely to avoid the noise, while others embrace agents to move faster. Those embracing the technology will likely experiment with automated rebasing, merge conflict resolution, and long-tail support across multiple projects.

Maintenance economics could also improve for projects that are feature-complete but require bursty upkeep. As Lorenc notes, many widely deployed projects are "just plain done." They are stable, tested, and rarely need new features, but they still require stewardship for security incidents and occasional updates. That is exactly the type of work agents can handle across hundreds of projects simultaneously.

## Enterprise delays create a widening autonomous advantage

The central asymmetry in autonomous agent security is simple but devastating. Attackers adopt autonomous capabilities immediately, while defenders in large enterprises remain slowed by governance, procurement, and security review.

On an exponential capability curve, even a normal enterprise delay creates a massive practical gap between attacker and defender effectiveness. As Lorenc points out, a two-year lag behind the rest of the industry used to be manageable, but with how fast things are moving now, that delay translates to being two decades behind in capability.

Security teams in regulated industries typically wait six to nine months or longer before adopting new technologies. They let others discover the risks and see what breaks. That conservatism has historically been prudent. But when capabilities are doubling every few months, a six-month lag does not just leave an organization behind, it leaves it defenseless.

Lorenc's recommended response is pragmatic: set up enterprise AI sandbox environments. Organizations should carve out time for developers to play with these tools on isolated laptops that do not have access to production codebases. The goal is not to eliminate governance but to build [developer intuition for AI tooling](https://linearb.io/blog/the-rise-of-product-engineers-in-the-ai-driven-era) as a critical defensive skill.

Teams need hands-on experience to judge which tasks agents can handle safely and where supervision is still required. Without that intuition, security teams won't know how to evaluate agent capabilities when they finally do adopt them.

Lorenc emphasizes treating agents as useful but fallible operators whose privileges must be tightly constrained. He advises assuming every agent is like a new intern who was just handed a laptop, noting that no one gives an intern root keys to production. The principle is straightforward. If you would not give a new intern access to production credentials, do not give an agent that access either. Agents will make mistakes, so systems must be architected to contain those mistakes before they cascade into incidents.

## Encoding trust into the agentic future

For engineering leaders, the takeaway is urgent. The attack-defense asymmetry is happening now. Organizations that delay hands-on AI experimentation in the name of security may find themselves so far behind the curve that no amount of catch-up investment can close the gap. The solution is structured experimentation that builds organizational capability while maintaining security boundaries.

The agentic transformation is not coming; it is here. Engineering leaders who treat AI as a distant concern will find themselves managing teams that cannot ship, dependencies they cannot secure, and threats they cannot defend against. The organizations that thrive won't be those with the fanciest AI tools. They will be those that [encoded trust, safety, and intent into systems](https://linearb.io/resources/software-engineering-benchmarks-report) resilient enough to handle whatever code comes next.

To hear more about the future of software supply chain security, listen to Dan Lorenc discuss these ideas in depth on the Dev Interrupted podcast.

## Improve developer productivity with LinearB

Find us on

[](https://www.linkedin.com/company/linearb)
[](https://devinterrupted.substack.com/)

![Headshot3_d7231cbda7](https://assets.linearb.io/image/upload/c_limit,w_2560/f_auto/q_auto/v1/Headshot3_d7231cbda7?_a=BAVMn6ID0)

## Andrew Zigler

Andrew Zigler is a GTM Engineer at LinearB and the host of Dev Interrupted, a twice-weekly podcast and newsletter where 40k+ builders decode the transition to AI-native development and agentic orchestration. A classicist by training with a degree from The University of Texas at Austin, Andrew spent his early career teaching in Japan before channeling his interdisciplinary instincts into the tech world. His polymath background informs everything he builds, from automated workflows to the stories he tells about the seismic shifts reshaping software creation.

### Connect with

[](https://www.linkedin.com/in/andrewzigler)
[](https://substack.com/@zigler)
[](https://x.com/andrewzigler)

## Your next read

[![Cover image for Rippling's employee graph turns HR data into an agentic AI platform](https://assets.linearb.io/image/upload/c_limit,w_2560/f_auto/q_auto/v1/Blog_Post_Name_2400x1256_be5ec4183f?_a=BAVMn6ID0)](https://linearb.io/blog/rippling-albert-strasheim-employee-graph-agentic-ai)

AI

[Rippling's employee graph turns HR data into an agentic AI platform](https://linearb.io/blog/rippling-albert-strasheim-employee-graph-agentic-ai)

Rippling CTO Albert Strasheim explains why the employee graph serves as the essential context layer for enterprise agentic AI. Discover how unifying HR, IT,...

[![Cover image for Deterministic guardrails must evolve to control probabilistic AI systems](https://assets.linearb.io/image/upload/c_limit,w_2560/f_auto/q_auto/v1/Blog_Post_Name_2400x1256_5_f5375661ec?_a=BAVMn6ID0)](https://linearb.io/blog/launchdarkly-cameron-etezadi-deterministic-guardrails-probabilistic-ai-darkfactory)

AI

[Deterministic guardrails must evolve to control probabilistic AI systems](https://linearb.io/blog/launchdarkly-cameron-etezadi-deterministic-guardrails-probabilistic-ai-darkfactory)

LaunchDarkly CTO Cameron Etezadi explains why traditional engineering pipelines are breaking down in a probabilistic, AI-driven world. Discover how to safely...

[![Cover image for Slack turns channels into the context engine for agentic AI](https://assets.linearb.io/image/upload/c_limit,w_2560/f_auto/q_auto/v1/Blog_Post_Name_2400x1256_077524ba8b?_a=BAVMn6ID0)](https://linearb.io/blog/slack-jaime-delanghe-mcp-agent-context-channels)

AI

[Slack turns channels into the context engine for agentic AI](https://linearb.io/blog/slack-jaime-delanghe-mcp-agent-context-channels)

Slack Chief Product Officer Jaime DeLanghe breaks down how channels serve as the foundational context layer for human-agent collaboration. Learn why Slack is...

## Structured data

_Machine-readable metadata (JSON-LD) embedded in the page for search/AI context — not content rendered on the page itself._

```json
{
  "@context": "https://schema.org",
  "@type": "Organization",
  "name": "LinearB",
  "url": "https://linearb.io/",
  "logo": "https://assets.linearb.io/image/upload/v1715628027/logo-mark-lg.svg",
  "description": "LinearB is the engineering productivity platform that helps engineering leaders prove AI is improving throughput without sacrificing delivery confidence, flow efficiency, or developer experience.",
  "sameAs": [
    "https://www.linkedin.com/company/linearb"
  ],
  "award": [
    {
      "@type": "Award",
      "name": "LinearB is a Leader in the 2026 Gartner® Magic Quadrant™ for Developer Productivity Insight Platforms",
      "dateAwarded": "2026",
      "awardedBy": {
        "@type": "Organization",
        "name": "Gartner®"
      }
    },
    {
      "@type": "Award",
      "name": "Great Place to Work Certification",
      "dateAwarded": "2025-2027",
      "awardedBy": {
        "@type": "Organization",
        "name": "Great Place to Work"
      }
    },
    {
      "@type": "Award",
      "name": "America's Best Startup Employers 2025",
      "dateAwarded": "2025",
      "awardedBy": {
        "@type": "Organization",
        "name": "Forbes Magazine"
      }
    }
  ],
  "hasCertification": [
    {
      "@type": "Certification",
      "name": "SOC 1 Type 2"
    },
    {
      "@type": "Certification",
      "name": "SOC 2 Type 2"
    },
    {
      "@type": "Certification",
      "name": "GDPR Compliance certification"
    },
    {
      "@type": "Certification",
      "name": "ISO 27001"
    }
  ]
}
```

```json
{
  "@context": "https://schema.org",
  "@type": "Article",
  "headline": "AI turns software supply chain security into a continuous engineering discipline",
  "url": "https://linearb.io/blog/dan-lorenc-chainguard-ai-supply-chain-security-guide-rails",
  "author": {
    "@type": "Person",
    "name": "Andrew Zigler"
  },
  "datePublished": "2026-04-01T07:00:00.000Z",
  "dateModified": "2026-04-01T07:00:00.000Z",
  "image": "https://assets.linearb.io/image/upload/v1775111898/Blog_Software_supply_chain_security_2400x1256_4537b892c4.png",
  "publisher": {
    "@type": "Organization",
    "name": "LinearB",
    "logo": "https://assets.linearb.io/image/upload/v1777485755/linearb-logo-2026.png"
  },
  "description": "Chainguard CEO Dan Lorenc reveals how AI is turning software supply chain security into a continuous engineering discipline, moving from restrictive guardrails to frictionless \"guide rails\" to handle a 500x increase in code volume."
}
```

## More on linearb.io

### Top navigation

- [Book a Demo](https://linearb.io/book-a-demo)
- [AI Code Reviews — Catch security risks, bugs, and spec mismatches](https://linearb.io/platform/ai-code-reviews)
- [AI & Productivity Insights — See how AI tools affect cycle time and delivery speed](https://linearb.io/platform/ai-developer-productivity-insights)
- [Measure AI Impact — Track AI adoption and tie it to delivery outcomes](https://linearb.io/use-case/measure-ai-impact)
- [MCP Server — Chat with your data to spot patterns and boost output](https://linearb.io/platform/mcp-server)
- [Resource Allocation — Cost initiatives and shape your investment strategy](https://linearb.io/platform/resource-allocation)
- [Cost Capitalization — Capitalize engineering costs with audit-ready reports](https://linearb.io/platform/cost-capitalization)
- [Dev Team Management — Set targets and tie throughput to business outcomes](https://linearb.io/platform/goals-and-reporting)
- [DevOps Workflow Automation — Policy-based PR routing, approvals, and tests](https://linearb.io/platform/ai-workflow-governance)
- [AI Powered Support — Unify AI and human code delivery in one clear view](https://linearb.io/use-case/ai-powered-support)
- [Optimization — Surface friction with feedback and MCP insights](https://linearb.io/platform/developer-experience)
- [Reporting — Spot what's working and what needs attention](https://linearb.io/use-case/measuring-developer-experience)
- [Surveys — Turn developer feedback into actionable signals](https://linearb.io/platform/developer-surveys)
- [Platform overview](https://linearb.io/platform/overview)
- [Register now](https://linearb.io/event/engineering-productivity-gap)
- [Customers](https://linearb.io/customers)
- [Pricing](https://linearb.io/pricing)
- [Why choose LinearB — Explore your data. Measure performance. Act to improve it.](https://linearb.io/why-linearb)
- [APEX framework — The operating model for AI-era engineering teams](https://linearb.io/resources/apex-framework)
- [Anti-FAQ — The questions other vendors won't answer](https://linearb.io/why-linearb/anti-faq)
- [Security — Enterprise-grade compliance and zero code access](https://linearb.io/security)
- [Build vs. buy — The hidden cost of building it yourself](https://linearb.io/resources/build-vs-buy)
- [Dev Interrupted Podcast — Conversations with engineering leaders](https://linearb.io/dev-interrupted/podcasts)
- [Reports & Guides — Deep dives on productivity and delivery](https://linearb.io/resources)
- [Webinars — Expert sessions on productivity and AI](https://linearb.io/resources?category=workshops)
- [Metrics Benchmarks — See how your engineering org stacks up](https://linearb.io/resources/software-engineering-benchmarks-report)
- [Blog — Product updates and practical insights](https://linearb.io/blog)
- [Help Center — Documentation, setup, and support](https://linearb.helpdocs.io)
- [API Docs](https://docs.linearb.io/api-overview)
- [Status](https://www.linearbstatus.com/)
- [Integrations](https://linearb.io/integrations)
- [LinearB Library](https://linearb.io/library)
- [Engineering metrics](https://linearb.io/library/engineering-metrics)
- [Platform engineering](https://linearb.io/library/platform-engineering)
- [Engineering glossary](https://linearb.io/library/engineering-glossary)
- [Developer productivity](https://linearb.io/library/developer-productivity)
- [AI in software development](https://linearb.io/library/ai-in-software-development)
- [Engineering management](https://linearb.io/library/engineering-management)
- [Developer experience](https://linearb.io/library/developer-experience)
- [DevOps](https://linearb.io/library/devops)
- [Engineering operations and the context layer](https://linearb.io/library/engineering-operations)
- [Engineering efficiency](https://linearb.io/library/engineering-efficiency)
- [Software delivery](https://linearb.io/library/software-delivery)
- [Research and data](https://linearb.io/library/engineering-benchmarks-and-research)
- [LinearB is a Leader in the 2026 Gartner® Magic Quadrant™ for Developer Productivity Insight Platforms](https://linearb.io/resources/gartner-magic-quadrant-dpi-platforms-2026)
- [Sign in](https://app.linearb.io/login)
- [Enterprise](https://linearb.io/solutions/enterprise)
- [Contact](https://linearb.io/contact-us)
- [About us](https://linearb.io/about-us)
- [Careers](https://linearb.io/careers)
- [Service agreement](https://linearb.io/services-agreement)
- [Privacy policy](https://linearb.io/privacy-policy)
- [DPA](https://linearb.io/data-processing-agreement)
- [Security FAQ](https://linearb.io/security-faq)
- [Substack](https://devinterrupted.substack.com/)

### Footer

_Additional links from the site footer, not repeated from the top navigation above._

- [GitHub](https://github.com/linear-b)
- [LinkedIn](https://www.linkedin.com/company/linearb)
- [Twitter](https://twitter.com/LinearB_Inc)