Chainguard

Chainguard has turned software supply-chain security — the abstract fear that became concrete after SolarWinds, Log4Shell, and the xz backdoor — into a product enterprises pay for eagerly, and its growth is among the fastest in all of security. Its hardened, minimal, continuously-rebuilt container images (on the Wolfi distro) ship with near-zero known CVEs, which converts an unbounded, never-ending vulnerability-remediation treadmill into a subscription: instead of a security team endlessly patching base images, they buy Chainguard's already-clean ones and reclaim thousands of engineering hours. The founding team's credibility is unmatched in the space — several created Sigstore and SLSA at Google, the open standards that define modern supply-chain security — so Chainguard effectively sells the commercial layer atop the standards its founders wrote. Investor conviction has been extraordinary: a $356M Series D in April 2025 at a $3.5B valuation, followed by a $280M growth infusion from General Catalyst in October 2025, bringing total funding to roughly $892M against a reported ARR that reportedly crossed $40M and is compounding at rare velocity. The category is expanding beyond images into libraries, VMs, and AI/ML artifacts — a natural surface as enterprises secure the models and dependencies feeding their AI systems. With regulatory pressure (SBOM mandates, secure-by-design directives) forcing supply-chain provenance into procurement, Chainguard sells a mandate-driven product with a moat of open-source authorship and a growth curve that justifies the mark.

Chainguard's roughly $892M raised and $3.5B valuation are priced for perfection against an ARR base — reportedly in the tens of millions — that, however fast-growing, is still small relative to the mark, implying a multiple only defensible if hypergrowth continues uninterrupted for years. The core product is also structurally exposed: hardened container images sit atop open-source distributions and rebuild automation, and the barrier to a determined competitor is engineering effort, not an unbreachable moat — Docker (Docker Hardened Images), Red Hat's UBI, Rapidfort, and the cloud providers all offer or can bundle "secure base image" equivalents, and any of them can give it away to protect a larger platform. The value proposition is partly a bet that enterprises will keep paying to outsource patching rather than adopt free minimal images (distroless, Alpine) and automate remediation themselves — a make-versus-buy calculus that can flip as tooling improves. Two large rounds in six months, including a General Catalyst growth vehicle, is a lot of capital to absorb and raises the bar for the eventual exit that must clear ~$892M of preferences. Supply-chain security is real and mandated, but it is a feature many platforms want to own; being the fast-growing pure-play is exciting until the platform vendors decide the category is strategic enough to commoditize.