Chainguard Assemble 2025 | Kim Lewandowski, Chainguard

Clips
More from Chainguard Assemble 2025

Kim Lewandowski

Co-Founder & CPO

Chainguard

play_circle_outline Announcement of new product offerings: ChainGuard Libraries and VMs

play_circle_outline Collaboration with partners like Datadog for enhanced observability

play_circle_outline The Importance of Customer Feedback in Outcome-Driven Product Development for Solving Real Problems

play_circle_outline Hope for adoption of new products and continued customer feedback in the future

Info
Transcript

Kim Lewandowski, Chainguard

Kim Lewandowski

Co-Founder & CPO Chainguard

Kim Lewandowski, product leader at Chainguard, joins theCube hosts Savannah Peterson and Jackie McGuire at the Chainguard Assemble 2025 event in San Francisco. Lewandowski reflects on their journey with Chainguard, from introducing the company at CubeCon to discussing the latest innovation highlights in software supply chain security and container management.

In this insightful conversation, Lewandowski shares their expertise in products tailored for enhanced security in the software supply chain. Joining theCube hosts, the interview delves into the st... Read more

explore Keep Exploring

What product has been the focus of the company up until now, and what are they considering building next? add

What has been the community reception like since announcing the news? add

What is the process internally for prioritizing what to build next and how does the company ensure it is customer focused? add

What topics were covered during the conversation? add

bolt Powered by CUBE AI

Kim Lewandowski, Chainguard

search

Savannah Peterson

>> Good afternoon, storage fans, and welcome back to a spectacularly sunny San Francisco, California. We're here midway through the day at ChainGuard Assemble. My name is Savannah Peterson, joined here in the cockpit of the rocket ship with Jackie McGuire today. Jackie, we are rip-roaring. We've already learned some really interesting things today.

Jackie McGuire

>> We have. I would say this has actually been one of the conferences I've pulled a lot of personal keys away from, especially dealing with containers and things like that. So, this has been fantastic.

Savannah Peterson

>> I know. It's nice to be in our happy place together. Thank you for sharing this time. Also, adding to our happy space right now, we've got Kim, who leads the product for Chain Guard. Thank you for taking the time today.

>> Yeah, thank you both for having me.

Savannah Peterson

>> You mentioned that you've been a part of thECUBE Fam, you're an alum VIP. Actually, brought Chainguard to the world here on the show.

>> That's right.

Savannah Peterson

>> So this is a very special reunion. What is it like for you to be around here? It's buzzing, your community is here, your customers are here. What does today feel like?

>> I have to pinch myself. It's one of those moments where, it's like you said, we introduced ourselves at CubeCon about three and a half years ago. And not knowing what we were going to build, we knew we were going to be in the software supply chain security space, but hadn't actually built any products yet. And see us here three and a half years later, and what we've been able to build, and the customers around us, it just makes me feel good inside, feeling like we're helping them, and we're solving problems for them. So that's anything any product person could want.

Savannah Peterson

>> Yeah, I mean, what an affirming feeling. I can tell, just so the audience knows, it's very real and genuine, what you're saying. I can feel from your energy just sitting here how much it means. Y'all had some very big announcements today, huge day in innovation in chain guard land. Can you walk us through some of the highlights for you on the product side?

>> Sure, sure. So, our flagship product to date has been chain guard images, or we provide hard and container images. And for a while now, over the last year, even internally, all the engineers, all the product people, "What's next? What's next? What are we going to build next?" And I'm like, "We're going to keep focusing on the containers. We will figure out what's next when it's time for us to figure out what's next." Well, we feel like we're at that time now. A lot of early customers of ours said, "Hey, we love containers, but you know what? We have a lot more software than just containers that we're worried about." And so we started down the path of looking at virtual machines, and specifically container hosts, which are running under the containers. And so that was an obvious next transition phase for us. And then Chainguard Libraries was the other big announcement today. So, there's still a lot of open source software. You have a container image, but developers still need to bring in other libraries from popular languages. And today it's a bit of the wild, wild west. They're just pulling code, not knowing who built it.

Jackie McGuire

>> Oh, I resemble that remark.

>> Yeah. So we use different analogies. Sometimes I like the food analogy, where it's like you're buying a bag mix of salad from the store, but you have no idea the ingredients that went into it or anything, so you're taking a big risk. So the library is meant to fill a lot of that gap where you're just getting those things from a trusted source. And we're going to do our damnedest to harden them as much as we can.

Savannah Peterson

>> Which is critical, congratulations.

>> Thank you.

Savannah Peterson

>> Big moment for y'all. I just want to throw some numbers here that I have in my notes. On the container images, you offer 1300 container images. Across those images you've remediated 72,000 CVEs, saving your customers 288,000 engineering hours. That is not insignificant. I can imagine that's only going to grow.

>> Yes, for sure. So, we started images early on and we knew about vulnerabilities obviously. And then after many customer meetings, and I think for me personally, you just ask more of these questions, and you latch onto the real toil that's going on inside of organizations. And a lot of times they literally have spreadsheets of the CVEs, and they try to assign an owner to them. And these are developers that have not, they're not maintainers of those open source projects, they just pull them in because they want to use them. That's the beauty of open source. So, now we've got massive spreadsheets just tracking these vulnerabilities, how are we going to fix them. And so I mean, that's where we've come in, and we've saved over, what was it, 288,000 hours. So we're doing that so your developers don't have to.

Savannah Peterson

>> Which is really compelling. I mean, we talk a lot, it's actually an acronym we haven't said today, so I won't cloud the conversation. We talk a lot in AI about saving time and productivity. There's a lot of other ways to also save time and productivity, and increase that sense of purpose by leveraging you all, which is so exciting. Let's dig in a little more on the VMs. Now, this is a totally new offering for the Chainguard community. How long have you been working on this as a product team? Give us the journey there.

>> Yeah, so in today's keynote, if you caught it, I'm not sure if anyone else has talked about this on the interview today, but we've sort of built this internal factory. So we've built a lot of these foundational pieces to produce our container images. So a lot of that machinery, if you will, we're able to use for a VMs product. The containers, we've called ourselves an industry before there was no kernel, but now we've introduced a kernel and other Linux components that are needed to run an actual VM. And so we've been working on it I think since around summertime. Actually Dustin, I think who was on the show earlier, was hacking together prototypes early on. And he is like, "We can do this." And we're like, "Yeah, does anyone care about VMs?" And he is like, "Yes, they care." And then of course we started talking to actual customers or prospects, and learned that there's a real market there, and it's similar for containers. They want minimal VMs, they want the CVE protection, or CVE SLAs around it. They want to make sure that it's coming, everything's built from source, it's coming from a trusted source. So we took a lot of the principles and the methodologies we use for containers to apply to the VM images. And so starting with a few more specific use cases around the container host, which I had mentioned. So what the containers is actually running on underneath, and looking at use cases that we call ephemeral. And so this is VM use cases where you know, workload is sort of spun up and then spun down, not like traditional really long-running workloads where we're a company, or we'll spin up a VM and leave it there for 10 years. That's not kind of what we're going after. What we do at Chainguard is a little bit different. We recognize the developers always want to use the latest and greatest, especially in our AI, new AI world. It's like they don't want to be, they need the new performance tweak, or they need the new functionality that came out, so with VMs. It's all the latest supported stuff, and you're meant to spin these up and spin these down, and stay on the latest and greatest, and not meant to keep these things running for years, accumulating vulnerabilities over time.

Jackie McGuire

>> And you guys also offer container host images for Amazon's managed services as well, right? So the EKS. I think I read one click deployment and I was like, "One click deployment. That would be nice." Can you tell us more about the integration with Elastic?

>> Yeah, so in Amazon it's the EKS node that hosts that we have. And we do have the VMs that work on all of the major clouds. But that's another thing about the VMs is they're cloud-agnostic. So we've got a lot of companies that need to run on different cloud environments. So, that's another benefit, is we've got the VMs that'll sort of work on any of these clouds. But the EKS one, same general principles apply where we're fixing the vulnerabilities. It's minimal. We're more of a, I think, general purpose solution, than some of the other things out there. So, as opposed to shoving everything into the VM and just hoping it works, we do what's just needed. And that reduces the attack surface, the size, quicker deployments, all of that goodness.

Savannah Peterson

>> So many benefits. And working with hyperscalers like that, it's a nice little funnel for your customer base as well, I'm sure. What's the reception like been in the community now that you've announced the news?

>> Yeah. So, I think this is what I've seen, is what we've been witnessing today, and lots of good questions around these things. And we announced a Datadog partnership too. So getting a lot of feedback on-

Savannah Peterson

>> Congrats.

Savannah Peterson

>> Thank you. Getting a lot of feedback on that kind of motion, it's like we have these observability tools that we're running. So we want to see all the places where we can apply Chainguard images, or see where our gaps are. So I think it's a really great opportunity for us to keep doing more of that, keep working with the people that are great at these observability things. And so a similar thing, they're like, "Oh, well we know where all our containers are running. Now, we actually want to go see where our VMs are running, or see what kind of place-"

Savannah Peterson

>> See what else is going on in here now that we realize we can.

>> Figure out where our developers are actually pulling in those libraries from, because oh, I didn't realize that was another.

Savannah Peterson

>> There's no rules here. .We welcome that kind of awesome passionate expression here, I mean, especially with the two of us sitting here.

Jackie McGuire

>> Yeah, I was like, "I'm only going to say fuck once today. I promise." So we had Dan on earlier, and he was talking about the interaction between say development teams and IT teams and security, and how sometimes security becomes the department of no. And when I was reading more about your new libraries, it seems to me like that's actually a great way for security to build bridges into data science teams. And that as a data scientist, I relied on so many packages, and so many things in Python, that I didn't intentionally write insecure code, I just didn't really understand. And so having the security team have the ability to do maybe an enablement for data science and say, "Hey, we have these new chain guard libraries, you need to be using these because these are vetted, not everything that comes from PIP is safe," do you think that's going to be the case and that this will help security teams more frictionlessly work with their counterparts in the organization?

>> Yeah, I think so. I think that's one thing that we understand intimately as product people and building this company is that we couldn't build a traditional security offerings unless developers were going to use it and not hate their security teams. And so we're all from background and developing ourselves. And anytime you introduce friction, it's not great. No one loves that. And so I do think there is a bit of a shift even internally, just having more security champions that are educating like engineers on some of these things. And I think the products that they want to introduce, they have to be easy, they have to be able to integrate them pretty seamlessly. And so I think libraries is a good example where you don't have to change too much, you just point to a different source of where you're getting those libraries from, and coming with insurances.

Savannah Peterson

>> Yeah, you talked about education and I asked Dustin this actually, so I'm going to ask you because I think it's kind of a fun game today. I think we're moving at a velocity in technology that even for an industry that moves very fast, we have not quite moved this fast historically. If you could sprinkle some magic fairy dust and educate the community or the world really on something related to security or what you all are doing, what would you make them all instantly know right now?

Jackie McGuire

>> I would say, security is always just a hard thing to measure. And you see some of these breaches, there's actually like some loss of lives that can happen with a real security breach. And it is scary, but it's really hard to tell somebody like you could be impacted by something you don't know today. So I mean, if I could be a future fortune-teller or something, it would be have them know that they could one day be impacted, and this is not going to be fun. So, if you could somehow tell the future. Now, I know that's not a great answer because we can't do that, but I would say on the flip side, just understanding that the actual supply chain, it is a big space, it's a new category, it's a new category when we started the company. But just think about it, and you can apply it to any sort of even physical good, or like I said, food earlier, and just like start asking the questions about that thing that you're consuming, that you're running in production. So, I think that's what I would say, just more awareness around what risks are involved in launching that code in production.

Savannah Peterson

>> And it's okay to be afraid of the dark. There might be parts of the business you're not aware of, like you talked about with the Datadog partnership, all the abilities to really dig in there. It's a great answer. Don't put your answers down. No, I think it's that we all don't know certain things. I mean, we don't know what the next round of hackers, we talk about this a lot, what they're conjuring up, or how long they've been embedded in systems. What is the tension like on the interior of your team? So I can imagine you all want, everybody wants certain things built quickly. Talk to me about your process internally and how you prioritize what y'all build next.

Savannah Peterson

>> Yeah. So, one of our core company values is be customer obsessed, and I think that's really key. At the end of the day, we need to be making sure that we're solving real customer problems. And so yeah, as we've acquired more and more customers, amazing for us, obviously, that's why we're here, is they're giving us a lot of feedback. "Something doesn't work, we've got friction here, hey, we need more." And so it's taking on all those inputs, finding patterns, getting the real strong signal, and then start working with the product managers and the engineering teams to map out the roadmap.

Jackie McGuire

>> I think it definitely shows, because there's a clarity of product vision at Chainguard that you don't always see at companies, and that virtually everybody I've interacted with today can tell me what you do, why it's important, the customers you're helping, the outcomes you're achieving.

Savannah Peterson

>> And why they're doing it now.

Jackie McGuire

>> Yeah, yeah.

Savannah Peterson

>> It's also really compelling.

Jackie McGuire

>> And I was just commiserating with somebody about, a lot of companies have their product managers drive the messaging, and you end up with this treatise on what's all the features they built that they think are really cool. Whereas Chainguard, it feels like you're significantly more focused on the outcomes that you're achieving with your products than all the bells and whistles in your products that you think are really cool.

Savannah Peterson

>> Thank you. That's like the best compliment I've ever heard.

Jackie McGuire

>> I know you brought us here and we're guests, but I'm also not very polite. So I wouldn't say that if I didn't honest, I would just vouch for this in a beautiful way.

Savannah Peterson

>> It's not always easy to prep for interviews. Research analyst is part of my job, and so it's not always easy because of that lack of clarity, but I have to commend that because I know it starts with you, and the focus on outcomes of your products versus features. So yeah, good work.

Jackie McGuire

>> Awesome, thank you.

Savannah Peterson

>> Nothing wrong with a little bit of a high five. I got to tell you something. I noticed walking in the door from the second I started seeing the team and security coming up the stairs, chatting with everyone, the wonderful team that we've worked with on all of these interviews, I'm just going to say it, I've never seen this many women at a technology conference. I think that it is maybe split 50-50 here. I've been striving for this day for almost 20 years here as a woman in technology. So I'm curious, because I just got to ask you, I mean know Dustin well enough to know that he's a recruitment baller, he's very good at attracting talent. Obviously clearly strong women here at Chainguard doing a great job, and the men, and every non-gender fluid human on the team. So, what is the culture like that around for you as a female leader in the C-suite here at the company? What's it like? How have you done so well? What can we learn from you to then tell all the other tech companies?

Jackie McGuire

>> Yeah, I don't know if it's the best answer, but I think it's going back to solving real customer problems. And I have that ear, I started as an engineer myself, and I was in a startup, and it was engineers just wanting to engineer something for the sake of it, without having anyone that needed that thing. And this light bulb moment went off in my head and I was like, "Wait a minute." There was no product managers back then. And so I think building these products that people are using and getting them to use them, and having their testament, just adds to what we're doing. And I think that's what's been helpful for me personally. And of course, just working with great people around the board. We just brought in Amber, I'm not sure if you all will get a chance to meet her soon, but she's on the product security team, helped us with a Datadog connection integration and everything. So, amazing to see folks like Amber come and join us, and really want to just keep pushing on the mission for us to make more open source, more safe.

Savannah Peterson

>> So it's basically just being awesome people doing awesome things.

Savannah Peterson

>> I think that's really what it comes down to. I'm not good at embellishing my own ego and stuff, but that's really what it is. We're fucking good at our job, and the talent comes, and we bring the talent in to keep kicking ass.

Jackie McGuire

>> Well, the empathy, right? The women, not all women, I know some women with no empathy, but many women bring the soft skills that are generally missing. And the focus on customer outcomes I feel is driven by empathy. It's driven by, "If I were using my product, what would I want it to do?" Not, "If I was building a product, what are all the bells and whistles I would want it to have?" And so I have to bring it back to, we need diverse teams because you're obviously killing it in your role. And I think a lot of that comes back to the soft skills, right? You understand what you want for outcomes from your customers, and it sounds like you guys have a relentless focus on the customer experience. I know you guys have some advisory boards coming up and things like that, so it's so awesome to hear that the soft skills we bring are being weaponized effectively.

>> And I think, well, it's hard to AB test this, but we're a remote, fully distributed company. And I think we're just sort of forced to communicate differently than being in an office. And I think it does help bring out the best of people too, being in that sort of type of environment where what you say in these meetings is really important and you don't have the same type of relationships as you would if you saw everyone at work every day. So, I think in a way that's sort of upleveled all of us too, from my personal view on that.

Savannah Peterson

>> Yeah. And being a little bit more thoughtful, allies across the board, everyone. When you're talking about best practices versus not bells and whistles versus not, I can't help but think of a Cybertruck versus a Ford F-150. One solves for solutions and challenges you have on a ranch, and one is just a bunch of rich guys making a truck that got recalled eight times and didn't sell. And it's like peak Silicon Valley example of what you just said. Had to throw out a casual Elon dig there, because why not? It's Tuesday and it feels good. I just need to keep that going. It's also for production over there.

Jackie McGuire

>> One of them pulled up outside the airport yesterday and I was like, "You could look almost as stupid for so much less money."

Savannah Peterson

>> I mean, yes, and you could show that you made smarter decisions based on solution-driven outcomes, which is exactly why it's relevant to this. One other thing you, we've got some great insights from your team, Jackie pulled up a lot of those from already today. There seems to be some really great curly hair on this team. You mentioned y'all have a nickname for Dan. What do you call Dan?

Jackie McGuire

>> Maybe It's my own nickname. But as I had mentioned when we did that intro with thECUBE back in 2021, Dan has been known, his hair has his own personality, and it just became its own meme on its own. And so over Covid and everything, his hair just kept growing longer and crazier. And on that video you're going to have to go pull up this same.

Savannah Peterson

>> Absolutely.

Savannah Peterson

>> His hair is just like flowing and I was so mad. I was like, "Your hair looks way better than mine."

Savannah Peterson

>> Hey, production, we need a fan right here, next time we film.

Savannah Peterson

>> So I call him Fabio.

Jackie McGuire

>> Well now I'm not going to be able to resist the urge to put him on a romance cover.

Savannah Peterson

>> There we go.

Savannah Peterson

>> That should actually be the event hero image. I'm not mad for this. All right, last question for you, Kim, because this has been awesome. You obviously had a really big day today. We hope to be back here next year at Assemble. What do you hope to be able to say a year from now that you can't yet say today?

Savannah Peterson

>> Oh, wow. I mean, I think it's adoption of those new products. That'll be the real testament that we sort of hit it again, and we've got real customers using these things and giving us feedback, and we keep making them better.

Savannah Peterson

>> Love that. Well, we look forward to having those customer stories, hopefully having some of them here in the community with us all on this table. We'll get a bigger table if we need to invite our friends. Kim, thank you for this. We got to cover the product. We got to cover Fabio. We got to cover the wonderful culture you have. And we did it with a little bit of spice and some swearing, which just really puts a bow on the whole thing for me. I love that promise. And we got to make fun of Elon. We really nailed it on this one. Jackie, always a pleasure to have you here. Great insights as always. Love your hot takes. And thank all of you for tuning in to our live coverage here at Chainguard Assemble in beautiful San Francisco, California. My name's Savannah Peterson. You're watching theCUBE, the leading source for enterprise tech news. Big happy moment up here for the powerful women in tech who love to swear. It's a good vibe.

Jackie McGuire

>> There's a lot of liberation when you just decide not to be professional.

Savannah Peterson

>> Well, stuffy. I think you...