Aqua Software Supply Chain Security

Aqua Software Supply Chain Security provides protection across the software development lifecycle from code to production. The platform scans source code, container images, and infrastructure as code to identify vulnerabilities, misconfigurations, exposed secrets, and malware at every release phase.

The solution monitors DevOps tools and CI/CD pipelines to detect security posture issues and misconfigurations. It analyzes open-source dependencies and grades packages based on quality, maintainability, popularity, and risk factors. Organizations can set and enforce quality standards for open-source code additions.

The platform generates digitally signed Software Bills of Materials (SBOMs) and implements integrity gates to validate artifacts throughout CI/CD pipelines. It provides static pipeline analysis for GitHub Actions, Bitbucket Pipeline, GitLab CI, Jenkins, CircleCI, and other CI/CD platforms to identify improper configurations.

CI/CD posture management capabilities enable organizations to audit privileges across the SDLC, enforce least privilege access policies, and implement separation of duties. The solution integrates with IDEs, source code management tools, CI pipelines, and cloud environment repositories to deliver in-workflow alerts.

Scanning is powered by Aqua Trivy Premium for consistent results throughout the SDLC. The platform connects code-level findings to runtime security events, enabling teams to trace issues down to specific lines of code for remediation.