SOFIAH NICHOLE SALIVIO

News Editor

Chainguard has joined AWS Security Hub Extended as a supply chain partner, giving AWS customers access to Chainguard Libraries through the service.

The integration places Chainguard in the new Supply Chain category within AWS Security Hub Extended, allowing customers to bring its package catalogue into existing AWS security workflows. Users can buy the offering through existing AWS contracts, with Enterprise Discount Program terms applied where relevant, and view findings alongside other security alerts in Security Hub.

The move comes as companies face growing concern over attacks targeting open-source software dependencies. These attacks can insert malicious code into widely used packages that developers pull into applications, creating a route into corporate systems before security teams detect a problem.

Chainguard says its Libraries product is designed to replace packages from public repositories such as PyPI, Maven Central, and npm with alternatives rebuilt from verified source code. Those packages are produced in its own build environment rather than taken directly from public registries.

Security Hub Extended is AWS’s broader marketplace and operational framework for security tools that run inside its cloud environment. By joining the service, Chainguard becomes one of the suppliers customers can activate from within the AWS console rather than through a separate buying process.

Open-source risk

The backdrop is a wider shift in cybersecurity from detecting threats after software enters an organisation to blocking suspect components earlier in the development chain. Open-source software underpins much of modern application development, but public package repositories have become a target for attackers seeking scale.

Chainguard argues that conventional scanning tools can miss the window when a malicious package is first published and quickly downloaded into software builds. It says more than 98% of malware ships as a pre-built package with no matching source code, making early verification of provenance more important than later inspection alone.

Its approach is to supply versions of common language dependencies rebuilt from source and accompanied by signed provenance and software bills of materials. The packages available through the AWS integration are rebuilt in a SLSA Level 3 build environment, according to Chainguard.

The AWS arrangement also changes how customers pay for and support the product. Rather than setting up a separate vendor relationship, customers can purchase through AWS and consolidate the spend into one bill while still relying on Chainguard’s expertise for the software itself.

For enterprise users, the service also brings unified Level 1 support from AWS for Enterprise Support customers. Security findings are centralised using the Open Cybersecurity Schema Framework, allowing data from Chainguard to sit alongside findings from AWS and other partners in a common structure.

Patrick Donahue, Senior Vice President of Product at Chainguard, addressed the significance of the partnership in the context of open-source risk.

“Open source is the foundation the world’s software is built on. When that ecosystem gets compromised, the blast radius is enormous,” Donahue said.

He also linked the AWS listing to broader recognition of supply chain security concerns.

“AWS adding us as a partner for supply chain security with the Extended plan is a real signal that the industry is treating this problem with the seriousness it deserves. Chainguard delivers that protection to customers with open source that’s trustworthy by default,” Donahue said.

Buying route

The commercial element may prove as important as the technical integration for some buyers. Procurement teams often slow adoption of new security tools because separate contracts, reviews, and billing arrangements add time and cost, particularly when development teams want to move quickly.

By appearing inside AWS Security Hub Extended, Chainguard gains access to organisations that prefer to buy third-party security products through a cloud provider they already use. The setup also lets customers apply AWS spending commitments and discount structures, which can make a new product easier to justify within existing budgets.

Chainguard is one of a growing number of security suppliers trying to address weaknesses in the software supply chain before code reaches production systems. Its customer list includes large technology and industrial groups, reflecting stronger demand for tools that monitor or replace open-source components used in commercial software.

Customers using AWS Security Hub Extended can subscribe to Chainguard Libraries through the Extended plan and configure it within their environments, with findings then surfaced centrally through Security Hub.

Speaking to the Henley Standard, Chris Dale, 66, from Hobbs End, Henley, said the leak, originating from a Thames Water meter, has been causing issues for residents since the beginning of June.

The water flows downhill in the cul-de-sac, reaching the junction with Valley Road.

Mr Dale said: “I have lived here and around all my life. I love Henley and I want it to look nice and at its best. This leak isn’t helping.

“When you leave water like this for so long, it looks terrible. It makes such a mess.

“Thames Water is aware of the leak—they’ve marked the drain, and nothing’s happened yet.”

Mr Dale was informed that the leak would be repaired on Thursday last week, but said there was “no sign of anyone.”

MP for Henley, Freddie Van Mierlo, recently hit out at the CEO of Thames for saying its leakage targets are unrealistic (Image: Contributed)

He said: “It’s not a good scenario, especially with all this hot weather at the moment and how long the leak has gone on for. Surely, we should be preserving water and not wasting it?”

“If you were to measure the amount of water each day for every day it’s been going on for, how many gallons would that be? It would be a lot.”

With a hosepipe ban being imposed by Thames Water last month, Mr Dale said he is “surprised” the leak has not been repaired yet.

He added: “Every time I look on the television, they’re saying to be careful with water, be careful how many times you shower and have a bath, which is fine. But then you have this amount of wastage on top of that, no wonder we’re in trouble.”

A spokesman for Thames Water said that it was planning the repair.

He said: “Leaks like this often require working with the local authorities, and in these cases, planning repairs can take a little longer.

“Once we’ve scheduled the repair, we’ll send a team to fix the leak.”

This “share” would give the government veto powers over decisions such as mergers.

The lenders are also proposing giving local authorities greater involvement in the firm.

CEO of Thames Water, Chris Weston, speaking on the BBC’s Big Boss Interview podcast, stated that some of the targets were beyond what they could achieve.

He said: “We have to hit a certain level of leakage, but it is so far in excess of what we are capable of doing, I think anyone would be capable of doing, however much money you invested, that it is not going to be achievable.”

Thames Water, the largest water company in the UK, has been under fire recently for its handling of sewage discharges and leaks.

Last year, it was fined a record £122.7 million by regulator Ofwat, largely for breaching sewage spill rules.

Ordnance Survey has reported record annual revenue of GBP £198.7 million, marking its 10th consecutive year of growth.

Revenue rose by GBP £4.1 million from the previous financial year, driven by the expansion of the National Underground Asset Register, growth in the OS Maps consumer app, and stronger demand from utilities, land and property customers.

A separate economic assessment cited by the organisation estimated that its work would generate GBP £10.6 billion in economic impact for the UK over the 10 years from the 2020-21 financial year to the 2029-30 financial year. Central to that calculation is the Public Sector Geospatial Agreement, a GBP £1 billion arrangement with government that gives public sector bodies access to Ordnance Survey data.

The figures show how far Ordnance Survey has moved beyond its historic identity as a producer of paper maps. It now maintains the National Geographic Database, a digital map of Britain containing 600 million location features and updated 30,000 times a day.

Use of that database grew by more than 30% over the year, while more than one million edits were made during the period. Since its launch four years ago, 16 data collections have been added and 70 major enhancements delivered.

Underground assets

A major part of the latest year’s growth came from the National Underground Asset Register, which Ordnance Survey operates for the government. The platform combines records of buried pipes and cables that were previously held by hundreds of separate asset owners.

With Openreach joining the system, the register now covers more than 3.2 million kilometres of pipes and cables, representing more than 80% of known underground infrastructure in England, Wales and Northern Ireland.

The service has also widened its user base. More than 10,000 people now use the platform, transaction volumes rose 115% during the year, and more than 70% of local authorities and 90% of highway authorities have signed up to share details of their assets.

The wider aim is to reduce accidental strikes during excavation work, which can interrupt water and power supplies, delay projects and create safety risks. By bringing the data into a single view, contractors can check what lies beneath a site before work starts.

Climate analysis

Ordnance Survey has also been using its data in climate and infrastructure analysis. Work combining its mapping data with Environment Agency flood data found that 12% of England’s roads and 20% of its rail lines could be exposed to climate-related flooding events.

Separate analysis identified 1.8 million homes at heightened wildfire risk on the edges of towns and cities. The organisation also said its subsidence modelling is being used to show where insurance claims are likely to be concentrated through to 2070.

In transport and energy planning, Ordnance Survey built a machine learning model with Transport for the North to identify which of the region’s 6.4 million households have driveways or off-street parking. Local authorities can use that information to target public electric vehicle chargepoint locations.

It is also working with the Met Office to identify where solar potential is being missed. These projects reflect a broader shift in how Ordnance Survey is positioning its data: from a reference tool to a source of analysis used in planning, resilience and investment decisions.

AI shift

Artificial intelligence has been part of Ordnance Survey workflows for more than a decade, used to extract features from aerial and street-level imagery for map updates. The next step, according to the organisation, is agentic AI systems that would allow users to query geospatial information through natural language.

That would let users interrogate location data for decisions such as where to place housing, mobile phone masts or other infrastructure. The plan points to a wider effort to make Ordnance Survey’s data easier to use across government and business.

Demand also increased across its commercial customer base over the year. Customer numbers rose by about 9% in utilities and 17% in land and property, according to the results.

On the consumer side, subscriptions to the OS Maps app increased 6% to 536,000, the highest total so far. Ordnance Survey also bought the remaining shareholding in Dennis Maps, reinforcing its position in the market for paper maps as well as digital services.

Nick Bolton, Chief Executive Officer of Ordnance Survey, said: “This year marked the 225th anniversary of our first map, and today, OS continues to innovate to meet the evolving needs of the nation. Our role is not just to provide data, but to ensure that it is continuously improving and delivering valuable insights: from mapping the pipes and cables beneath our streets to the flood and wildfire risks facing the communities above them. This work is helping both public and private sectors make better decisions about where to build, what to protect and how to unlock economic growth, as well as social and environmental opportunities.”

He added that the organisation had completed a six-year programme to build its data foundation and was now focused on broader access. “This demand for trusted location data has delivered another year of growth, and with a six-year programme to build our data foundation now complete, our focus is now on making data more accessible to more people and organisations. Doing so will deepen our role as a strategic partner to government while creating greater value for customers across the private sector and strengthen our role as Britain’s national mapping service,” Bolton said.