As AI-driven development accelerates and open source dependencies continue to multiply, the security risks hiding inside cloud-native applications have never been greater. Ahead of KubeCon EU 2026, VMblog sat down with Tyler Warden, VP of Product at Sonatype, to explore how organizations can maintain visibility and control over their software supply chains without sacrificing the velocity that modern development demands. Sonatype will be on the show floor at booth 688, with an activation zone at 860 featuring a bowling activity designed to reinforce the importance of AI guardrails — a theme that runs throughout everything the company will be showcasing at the event.
From automated policy enforcement baked directly into developer workflows and CI/CD pipelines, to their community-driven Security Slam initiative co-organized with the CNCF Technical Advisory Group for Security and Compliance and OpenSSF, Sonatype arrives at KubeCon EU 2026 with a clear message: the greatest risk in cloud-native environments isn’t the infrastructure — it’s what’s flowing through the software supply chain. Warden shares how Sonatype’s unique supply chain intelligence platform helps teams identify vulnerable or malicious components early, govern open source across the full development lifecycle, and build the kind of security foundations that let organizations move fast and stay secure as AI tools generate more code and recommend more dependencies than ever before.
++
VMblog: What’s your elevator pitch for KubeCon EU 2026? If attendees only remember one thing about your company after visiting your booth, what should it be?
Tyler Warden: Our message is simple: as cloud-native development accelerates with AI, open source, and containers, the biggest risk and potential is not necessarily the infrastructure — it’s the software supply chain. Sonatype gives organizations the visibility and automated governance they need to understand what’s entering their applications and manage risk early in development, so teams can move quickly and keep Kubernetes environments secure.
VMblog: Where exactly can attendees find you on the show floor, and what’s the one must-see demo or experience you’ve built that showcases your technology’s real-world impact?
Warden: We will be hosting a bowling activity at our activation zone (860), which is designed to reinforce the theme of having AI guardrails in place. Throughout the event, we will also be highlighting Sonatype Guide and running demos at our booth, located at 688. We’re most looking forward to discussing AI and ML, App Development, and Security track sessions.
VMblog: Are you hosting any booth talks, mini-sessions, or expert Q&A opportunities? What knowledge can attendees gain without attending a formal session?
Warden: We will have a team of experts at the booth throughout the event who can talk through common software supply chain challenges and how teams are addressing them in cloud native environments. Attendees can stop by for short demos, practical discussions about open source governance, and advice on how to reduce risk in their development pipelines. Even in a quick conversation, visitors can learn how to gain better visibility into their dependencies and automate security checks earlier in the development process.
VMblog: AI and machine learning workloads are becoming first-class citizens in Kubernetes environments. How does your solution address the unique infrastructure and operational demands of AI/ML pipelines?
Warden: AI and machine learning rely heavily on open source frameworks and libraries. These components move through containerized environments and automated pipelines just like traditional applications. Our approach focuses on helping teams understand exactly which components they are using and identifying risks before those components enter production environments. This gives organizations the confidence to build and deploy AI workloads while maintaining control over the software supply chain.
VMblog: Security, compliance, and governance remain top concerns. What’s your approach to helping organizations build secure, compliant cloud-native systems without sacrificing velocity?
Warden: Our focus is on building security and governance directly into developer workflows. By integrating automated checks into AI agents and coding assistants, CI/CD pipelines, container build processes, and development tools. This reduces the need for manual reviews later and helps teams make the right decisions the first time and fix issues quickly. The result is stronger security and compliance while allowing developers to keep moving at the pace cloud native development requires.
VMblog: As we enter 2026, what’s your unique value proposition? With dozens of vendors claiming similar capabilities, why should CTOs choose your solution?
Warden: Our focus is the software supply chain and our unique supply chain intelligence that powers our platform. Modern applications depend heavily on open source components, containers, AI models and third party packages. Sonatype helps organizations understand what is entering their applications and govern those inputs across the development and application lifecycle. By providing unique intelligence coupled with automated policy enforcement, we help teams reduce risk while maintaining the speed and flexibility that cloud native development demands.
VMblog: Are you organizing any exclusive customer events, partner meetings, or community gatherings during the conference? How can interested attendees connect with your team outside the booth?
Warden: Security Slam is a community initiative tied to KubeCon that helps open source projects strengthen their security practices. Organized by the CNCF Technical Advisory Group for Security and Compliance, OpenSSF, and Sonatype, the event invites maintainers and contributors to complete a series of practical tasks that improve security hygiene within their projects. These activities focus on areas such as vulnerability management, documentation, secure development practices, and better visibility into dependencies.
The goal is to improve security earlier in the software ecosystem. Instead of focusing only on protecting organizations that consume open source, Security Slam encourages projects to build stronger security foundations at the source. Sonatype has supported and sponsored the initiative every year, helping drive community collaboration and raise the overall security baseline across the cloud native ecosystem.
VMblog: Looking beyond KubeCon EU 2026, what emerging trends or technologies should cloud-native practitioners be preparing for? What’s on your company’s innovation roadmap that signals where the industry is heading?
Warden: Cloud native development is moving even faster as AI tools begin generating more code and recommending OSS libraries automatically. That means the volume of open source entering applications will keep growing. Teams will need better visibility into the components and containers they are using and stronger controls over what enters their development pipelines. At Sonatype we are focused on expanding automation and intelligence across the software supply chain so organizations can identify vulnerable or malicious components earlier and manage risk without slowing development.
In cloud-native environments where container images are constantly being built and deployed into Kubernetes clusters, understanding the software supply chain becomes critical.
VMblog: As AI accelerates software development and code generation, developers are pulling in more open-source components than ever. How important are guardrails in the software supply chain, and what role should automation play in preventing risky or malicious dependencies from entering Kubernetes environments?
Warden: Guardrails are essential because developers are working faster and often pulling in dependencies automatically through tools and frameworks. Without clear policies and automated checks it becomes very easy for vulnerable or even malicious components to enter the pipeline. Automation helps enforce standards consistently across repositories, containers and Kubernetes environments. It allows teams to flag or block risky components early in development so problems are addressed before they reach production.
VMblog: Open source underpins nearly every cloud-native application today, but the volume and complexity of dependencies continue to grow. What challenges does this create for organizations trying to maintain visibility and control over their software supply chains?
Warden: One of the biggest challenges is simply understanding what is inside an application. A single service may depend on hundreds of open source libraries, and each of those libraries brings its own dependencies. This creates a large and constantly changing component graph that is difficult to track manually. Without clear visibility it becomes harder to identify vulnerabilities, enforce policy or respond quickly when a new risk is discovered.
VMblog: With AI tools generating code and recommending dependencies at scale, how should organizations rethink software supply chain security to keep pace with AI-driven development?
Warden: Organizations need to assume that software creation will continue to accelerate. Security and governance therefore need to happen automatically and early in the development process. Teams should build policies and automated checks directly into developer workflows and CI/CD pipelines so that every dependency is evaluated as it enters the environment. This approach allows developers to move quickly while still maintaining control over what is being used in production.
##
