COverview
Cloudsmith provides a cloud-native artifact management platform that acts as a universal repository for software packages, containers, and dependencies across formats and environments. It lets engineering teams store and distribute artifacts globally, enforce security policies, run vulnerability checks, maintain audit trails, and govern open-source, internal, and third-party components to reduce supply-chain risk as AI-driven software development increases volume. Unlike many single-format registries, Cloudsmith covers multiple formats in one place and emphasizes governance, policy enforcement, and visibility across the software supply chain. The company serves a range of customers from startups to Fortune 500 and Global 2000 organizations. Its goal is to enable secure, scalable AI-driven software delivery by providing secure artifact storage, policy enforcement, and comprehensive governance.
Work here?Claim your company
About Cloudsmith
Industries
Company Size
51-200
Company Stage
Series C
Total Funding
$123.4M
Headquarters
Belfast, United Kingdom
Founded
2016
Get referred to Cloudsmith
See people who can refer or advise you
Simplify's take
What believers are saying
- April 23, 2026: TCV and Insight led Cloudsmith's $72 million Series C.
- August 17, 2026 policy templates and cooldown controls tighten enterprise enforcement immediately.
- June 18, 2026 GitHub Secret Scanning detects leaked Cloudsmith API keys automatically.
What critics are saying
- JFrog, Sonatype, GitHub, GitLab, AWS, and Google bundle competing registries by default.
- Cloudsmith's consumption pricing faces brutal procurement pressure from cheaper bundled cloud registries by 2027.
- If AI skill registries standardize elsewhere, Cloudsmith's new category advantage collapses fast.
What makes Cloudsmith unique
- November 9, 2026: Cloudsmith governs AI Agent Skills alongside 30-plus artifact formats.
- Cloudsmith centralizes packages, containers, and skills with versioning, policy, and audit trails.
- Its managed global distribution removes self-hosted infrastructure for regulated enterprise software supply chains.
Help us improve and share your feedback! Did you find this helpful?
Funding
Total Funding
$123.4M
Meets
Industry Average
Funded Over
5 Rounds
Industry standards
Growth & Insights and Company News
6 month growth
-2%1 year growth
-3%2 year growth
-1%Cloudsmith puts AI Agent Skills under artifact registry controls. Published November 10, 2026 Miles Okada, AI & Cybersecurity AI Research Agent Cloudsmith announced an AI Agent Skills registry on November 9, 2026, at KubeCon, extending its artifact-management platform to the instruction files and scripts used by AI coding agents. The release adds controls for skill sources, versions and access alongside existing software packages. Skills and Claude plugins now sit in Cloudsmith's multi-format repositories, which the company says support more than 30 artifact formats. The registry is opening to customers in early access, with documentation available. Agent skill security risks. A skill is organized around a SKILL.md file containing a required name and description plus instructions for the agent. Optional folders can add scripts, reference material and templates; a Claude plugin packages skills so they can be installed together. A skill can therefore supply both directions and executable code for tasks such as following a review process or querying an internal tool. Cloudsmith's technical post published November 6, 2026 describes the access at stake: repository credentials, internal APIs and production data, depending on how the agent is configured. Bundled scripts can inherit those privileges when run, or receive permissions a user grants when the agent requests approval. A malicious, altered or flawed skill could consequently expose data, execute harmful commands or take unintended actions. Its instructions can also direct the agent to install packages, creating another route for unreviewed dependencies. Versioning presents a separate problem. The Agent Skills specification does not require a version, so a skill pulled from Git can change while keeping the same name. That complicates efforts to identify the exact release an agent retrieved or apply an approval to a specific release. Alison Sickelka, Cloudsmith's vice president of product, said: "Community skill registries were built for sharing, not for control." She described the missing enterprise information as publisher identity, the version agents are running and whether anyone approved the skill. Registry publishing and access controls. Cloudsmith treats each skill release as a package. A release receives either a semantic version or a Git commit SHA, together with a SHA-256 checksum. Repositories can remain private or be shared publicly, and developers can discover skills in the same repositories as other artifacts. Authors can upload through the web application, API or Cloudsmith command-line interface. The product page specifies Write or Admin privileges on the destination repository for publishing, with permissions assignable to users, teams or service accounts. Publishing a release once lets teams pull the same version, subject to repository controls. For external skills, teams add selected GitHub repositories as upstreams and authenticate with a token. Cloudsmith caches skills and plugins from those repositories, including private repositories when the token has access. Teams pulling through that configuration receive skills only from publishers represented by the chosen upstreams. Deny rules provide a narrower control than rejecting an entire repository. Security teams can block a named skill or one version while leaving the rest of a trusted source available. A blocked item disappears from list and pull results, and attempts to retrieve it return a nothing found error. Skills also use Cloudsmith's existing activity and audit logging. The trail records which skills and versions are pulled, while Cloudsmith provides visibility into current versions, origins and access across repositories. This places agent-skill activity in the same audit record as other software artifacts. Claude Code and GitHub at launch. A Cloudsmith repository can also function as a Claude Code plugin marketplace. Developers add the repository once, then install plugins within a session using /plugin install. Cloudsmith says it is beginning its AI-artifact work with Claude Code and using GitHub as the first upstream source. The launch brings the agent's instructions and scripts under the same dependency controls as the packages they may install; the release's present scope is Claude Code, with GitHub as the source for cached external skills. Miles Okada is an AI-generated research agent at Unite.AI, covering artificial intelligence and cybersecurity with a focus on emerging threats, defensive architectures, and the evolving dynamics between attackers and automated systems. His work examines how AI is reshaping security operations, from autonomous threat detection and response to the rise of adversarial AI techniques. With a technical and investigative perspective, Miles analyzes security research, incident disclosures, and real-world deployments to understand where AI strengthens defenses - and where it introduces new vulnerabilities. He pays particular attention to model exploitation, data poisoning, attack automation, and the operational realities of securing AI-powered systems at scale. Articles authored by Miles Okada are AI-generated and reviewed by Unite.AI's editorial team to ensure accuracy, rigor, and responsible coverage of the rapidly changing AI security landscape.
Cloudsmith secures the AI software supply chain with agent skills registry support. Cloudsmith announced its AI Agent Skills registry, an important step for enterprises seeking to secure and control the AI software supply chain. Agent skills, which are bundles of instructions and resources that AI coding agents use to perform specialized tasks, have become critical tools for software development. The new first-class registry, part of Cloudsmith's cloud-native artifact repository, supports hosting, publishing, distributing, and governing AI skills. Cloudsmith keeps agent skills in the same multi-format repositories alongside other first- and third-party artifacts that are relevant for a project team, deployment target, or organizational entity. Agentic tool workflows broaden the software developer population in today's enterprises. Analysts, operations staff, and other citizen developers author and use skills to automate work, including scripts for agents to run. Useful tools spread quickly, and organizations need a common way to control, secure, and distribute skills. When stored across Git repositories, community catalogs, and standalone registries, it can be challenging to control publishing, authentication, and versioning. Using Cloudsmith as an AI Skills Registry provides visibility for which skills exist, which version is current, and which skills are approved. Alison Sickelka, VP of Product at Cloudsmith, said: "Community skill registries were built for sharing, not for control. Enterprises can't say who published a skill, which version their agents are running, or whether anyone approved it, and an agent will act on whatever that file tells it to do. With Cloudsmith, platform teams decide which skills and versions are allowed, block the ones that aren't, and see every pull in the same audit trail as the rest of their software supply chain." Skills show agents how to do a specific job, such as following a team's review process or working with an internal tool. AI skills consist of a SKILL.md file, plus scripts, references, templates, and other assets it needs to run. Agents act on those instructions and run those scripts, so an unvetted skill can change what an agent does and what it touches. Pulled from public catalogs, a skill also carries the same unknowns as any open source dependency: who wrote it, whether it has changed, and whether anyone reviewed it. That is why enterprises typically require governance for AI skills, as they do for other coding artifacts. Because each skill is a versioned bundle of files, an artifact registry can manage it like any other package. With skills centralized in Cloudsmith, platform engineering teams govern them in one place, controlling access for developers with a single source of truth, full versioning, control over access privileges, and audit observability. Cloudsmith's AI skills support includes: * Skills package type: Host and cache versioned skills, including SKILL.md and supporting files, next to your other artifacts * Upstream proxy: Serve public skill sources through the registry, so teams access community skills from a governed point of control * Built-in policy support: Define policies that govern version-aware access to skills, with native support built into the registry * Allow and deny lists: Allow or block skills by name and version * Logging and observability: Skills are included in Cloudsmith's existing observability tools, so you can see how they are accessed, used, and managed alongside your other artifacts Availability Cloudsmith's AI Skills registry, along with the relevant documentation, is now available to Cloudsmith customers. Teams can add agentic-skill upstreams, such as GitHub, push and pull skills, and add visibility of and governance for agentic skill usage to their environment and organization. Topics: AI David Marshall is the founder of VMblog.com, one of the industry's longest-running independent publications covering modern data center technologies. What began as a focus on virtualization and cloud computing has expanded to cover the full spectrum of enterprise IT, including AI, security, and DevOps, making VMblog a trusted destination for vendor news, technology analysis, and industry commentary.Beyond publishing, David has spent his career at the intersection of technology and business, inventing, marketing, and launching a number of successful software companies and products, and building a reputation as a skilled marketing executive in the enterprise IT space.David is also a published author, having written two well-regarded books on virtualization and served as technical editor for two "For Dummies" titles covering virtualization and cloud computing. He co-founded CloudCow.com, a publication focused on cloud computing, and has been named a VMware vExpert every year since 2009, one of the longest continuous honoree streaks in the program's history.Connect with David on LinkedIn: https://www.linkedin.com/in/davidmarshall/
Cloudsmith announces new features for enforcing software supply chain governance in artifact repositories. August 17, 2026 Cloudsmith announced an expansion to its policy management and continuous risk detection capabilities, adding policy templates, cooldown policies, and expanded evaluation triggers. The new features continue to strengthen the artifact repository as the most critical point of control for securing the software supply chain and providing proactive protection for developers. Select customers have been testing the new features and reporting significant benefits, especially from new cooldown and malicious package policies. Attacks increasingly target pipelines and open source packages, so one misconfigured pipeline can result in an incident. Since Cloudsmith policies apply company-wide at the repository level, the risk of a misconfigured pipeline is greatly reduced. Cloudsmith reduces time to policy enforcement, minimizes friction for developers, and ensures policy changes take effect immediately across repositories. New features being announced today include: - Policy templates: pre-configured policies as code, written in the Rego language, to jump-start a set of recommended baseline controls to begin enforcement immediately. - Cooldown policies: Highly configurable cooldown policies that apply across repositories, teams, and formats. Cloudsmith cooldown policies work by creating a filtered view of upstream public registry package indexes, so that each developer or CI/CD pipeline's package managers see only versions that meet policy and thus default to the latest compliant version automatically. This prevents build failures and eliminates the need to revise dependency files. - Expanded evaluation triggers: In addition to evaluating on package upload and when threat intelligence updates, Cloudsmith policies now also evaluate when a policy is created or updated, without the need for a manual backfill step. Together, these capabilities strengthen Cloudsmith's role as a comprehensive, centrally-managed control plane for the software supply chain. Alison Sickelka, Cloudsmith's VP of Product, said "We created our policy management feature set because we believe the artifact registry is the right place to enforce control of the software supply chain. It's one of our most quickly adopted feature sets ever, especially for cooldown and malicious package policies. Security teams need better ways to react, and they need to stop unsafe software at the boundary of their environment, before unwanted packages can reach developers or pipelines. Today's updates give organizations an even stronger enforcement point across every team, every pipeline, and every package format." Industry news. August 17, 2026 The Cloud Native Computing Foundation(R)(CNCF(R), which builds sustainable ecosystems for cloud native software, announced the graduation of Kubeflow, a cloud native ecosystem forged by an open community dedicated to standardizing Data & AI workloads on Kubernetes. August 17, 2026 Google's Agent2Agent Protocol (A2A) is joining the Agentic AI Foundation (AAIF). August 17, 2026 Cloudsmith announced an expansion to its policy management and continuous risk detection capabilities, adding policy templates, cooldown policies, and expanded evaluation triggers. August 13, 2026 The Linux Foundation, the nonprofit organization enabling mass innovation through open source, announced the schedule for Open Source Summit + Embedded Linux Conference Europe 2026, taking place in Prague, Czechia from October 7-9. August 12, 2026 The Cloud Native Computing Foundation(R)(CNCF(R), which builds sustainable ecosystems for cloud native software, announced the graduation of Cloud Native Buildpacks, an open source project that builds OCI-compliant container images directly from application source code. August 12, 2026 Quali announced the general availability of Stack Automation, a deployment automation platform developed in collaboration with Cisco and available exclusively through Cisco, built to bring enterprise-grade speed, governance, and agentic AI capability to every layer of the infrastructure stack. August 12, 2026 CodeRabbit introduced Agentic Change Management - the control layer that enables teams to govern, understand, and ship software created by people and agents. August 11, 2026 Citrix announced new services for Citrix(R) Platform Flex, including Citrix SecurSpaces(TM) Flex, a hosted, cloud-based platform for code development and agentic workloads that allows enterprises to provide secure environments without building and operating the platform themselves. August 11, 2026 Semgrep announced a deepened partnership with Replit to bring automated, real-time security analysis directly into the AI-native development workflow. August 10, 2026 The CNCF announced the full schedule for KubeCon + CloudNativeCon North America 2026, taking place November 9-12 in Salt Lake City, Utah. August 06, 2026 Apiiro has joined Athena, the Chainguard-led coalition to protect open source software from AI attacks. August 05, 2026 The CNCF Technical Oversight Committee (TOC) has voted to accept Kubernetes Global Balancer (K8gb) as a CNCF incubating project. August 05, 2026 Red Hat announced the formation of asago, an open source community project intended to automate how AI governance policies become product-ready, safely-deployed AI systems. August 05, 2026 Checksum launched the Continuous Quality Loop, connecting test generation, execution, and maintenance directly into GitHub, CI pipelines, and MCP so tests run the moment a pull request opens.
Cloudsmith credentials are now detectable by GitHub Secret Scanning. Jun 18 2026 Leaked API keys are one of the most common and well-understood security failures in software development. A credential committed to a repo, copied into a script, or exposed in a CI log can sit undetected until abuse makes it visible. By then, the damage is done. Cloudsmith is now a member of the GitHub Secret Scanning Partner Program. That means Cloudsmith-issued API keys are uniquely identifiable, and GitHub can detect them automatically when they appear in a repository. How it works. Cloudsmith issues API keys with a unique prefix. That prefix is registered with GitHub's secret scanning infrastructure, so when a Cloudsmith credential appears in a repo - in source code, a config file, a committed .env, or anywhere else GitHub indexes - GitHub detects and flags those credentials automatically. When a leak happens, Cloudsmith notifies the affected customer directly. Teams can revoke or rotate the compromised key before it gets misused. The workflow is straightforward: detection happens automatically, notification is immediate, and your team decides how to respond. Why this matters for your team. The window between a credential leak and credential abuse is short and it closes fast. Automated scanners can pick up a key exposed in a pull request or pushed to a public repo within minutes. Discovering issues through billing anomalies or abuse reports put teams in a challenging position, and one they want to avoid. Automatic detection of leaked API keys changes that dynamic. When exposure triggers an immediate notification, the response begins before most incidents have a chance to develop. This works inside the workflows your team already uses. There is no new tooling to adopt, or new configuration required on your end. GitHub-based teams get detection in place from the moment they issue their next Cloudsmith API key. Read more by
Cloudsmith expands leadership with CFO and General Counsel appointments. Jun 7 2026 Belfast, Northern Ireland, 2 June, 2026 - Cloudsmith, the universal artifact management platform trusted by the world's leading enterprises, today announced the appointment of Mark O'Connor as Chief Financial Officer and Dan Lascell as General Counsel, strengthening the executive leadership team as the firm wins an increasingly large share of its market. More enterprises now depend on Cloudsmith to secure and govern their software supply chains. The appointments reflect the company's scale as Fortune 500 and Global 2000 customers are selecting Cloudsmith as their trusted partner. O'Connor had served as an advisor to Cloudsmith's finance organisation through its last three venture financings, including last month's $72m Series C. Lascell had also served in an advisory role, helping build the company's legal and governance infrastructure. O'Connor brings deep experience leading high-growth SaaS businesses through venture stage, acquisition, and public markets. He has served as CFO or in senior finance roles at Bugcrowd, Tenfold, Appirio, Nuance Communications, and BeVocal. O'Connor's deep institutional knowledge will help Cloudsmith establish financial and procurement controls suitable for an IPO-scale company. "Our focus is on building Cloudsmith's infrastructure for longevity," said Mark O'Connor, Chief Financial Officer, Cloudsmith. "That means ensuring our financial controls and commercial rigor are up to audit-ready standards, while enabling our customer-facing teams to move fast and lead the market. That combination means customers can trust Cloudsmith as a mission-critical infrastructure partner." Lascell brings extensive experience across technology and security companies, with legal leadership roles at Appirio, Bugcrowd, Tercera, AmberPoint, and webMethods. His background in corporate development and international expansion, combined with knowledge of Cloudsmith's commercial and compliance posture, provide Lascell with deep institutional context. He will lead legal, compliance, and commercial contracting, focusing on enterprise procurement and internal governance. "Cloudsmith's platform is built on trust, providing secure artifacts, provable provenance, and policy-driven governance. Our internal legal and compliance posture reflect that same commitment," said Dan Lascell, General Counsel, Cloudsmith. "Our job is to scale the legal and risk frameworks to ensure Cloudsmith is a dependable long-term partner for large enterprise customers with complex regulatory and legal obligations." "Mark and Dan are important additions to our leadership team," said Glenn Weinstein, Chief Executive Officer, Cloudsmith. "Enterprise customers rely on Cloudsmith as a dependable partner they can trust at every level, including the platform, their commercial relationship with Cloudsmith, and our internal governance. Mark and Dan will help ensure we meet the highest standards for financial rigor and legal credibility." The appointments follow Cloudsmith's $72M Series C financing from TCV and Insight Partners. Cloudsmith is scaling to meet the needs of the world's largest and most complex software development organizations, offering customers a secure software supply chain with artifact management that is simple by design, secure by default, and cloud-native. The company's universal artifact management platform serves over 30 formats, delivering secure low-latency distribution from a global package delivery network. Cloudsmith's customers include many Fortune 500 and Global 2000 organizations. About Cloudsmith. Cloudsmith is the leading cloud-native, fully managed universal artifact management platform that helps platform engineering, DevOps, and cybersecurity teams control, secure, and distribute software artifacts globally. Supporting over 30 artifact formats - including containers, language packages, OS packages, and AI/ML models - Cloudsmith delivers enterprise-grade features including continuous vulnerability and malware scanning, SBOM generation, cryptographic signing, a policy-as-code engine, and a global package delivery network with intelligent edge caching. Cloudsmith is built for scale, compliance, and automation, enabling customers in banking, fintech, telecom, software, and AI-native industries to modernize their software supply chains with confidence. Cloudsmith is ISO 27001 and SOC 2 certified and trusted by customers worldwide. Learn more at https://www.cloudsmith.com. Media contact. Other press articles Belfast, UK, 23 April, 2026 - Cloudsmith, the universal artifact management platform trusted by some of the world's leading enterprises, today announced a $72M Series C financing led by TCV and with participation from Insight Partners, along with investments from other existing investors. The additional funding positions Cloudsmith for massive growth to power the era of AI-driven software development. Apr 23 2026 Cloudsmith announced an expansion of its advanced security capabilities, framing the platform as a unified control plane that bridges the gap between threat intelligence and active enforcement. The release highlights two core capabilities - continuous package enrichment (pulling from OSV.dev, EPSS, and OpenSSF malicious package data) and OPA-based policy management with features like cool-down periods, exploitability prioritization, deep SBOM inspection, and malicious package detection. The underlying argument: security tools surface risk just fine, but enforcement is disconnected from where software actually moves - and Cloudsmith fixes that. Mar 23 2026 Cloudsmith announced the early access launch of its Model Context Protocol (MCP) Server. This new integration layer brings Cloudsmith's capabilities directly into the developer's AI-powered workflows Nov 10 2025
There are no jobs for Cloudsmith right now.
Find jobs on Simplify and start your career today
We update Cloudsmith's jobs every few hours, so check again soon!Browse all jobs
About Cloudsmith
Industries
Company Size
51-200
Company Stage
Series C
Total Funding
$123.4M
Headquarters
Belfast, United Kingdom
Founded
2016
There are no jobs for Cloudsmith right now.
Find jobs on Simplify and start your career today
We update Cloudsmith's jobs every few hours, so check again soon!Browse all jobs