October 22, 2026 – Anchore has become an official OpenChain Partner in the Vendor category, joining a global network of organizations that support adoption of the OpenChain standards. The partnership will help organizations use SBOM and vulnerability management tooling to build and demonstrate open source compliance programs aligned with ISO/IEC 5230 and ISO/IEC 18974.
The OpenChain Project, hosted by the Linux Foundation, maintains ISO/IEC 5230, the international standard for open source license compliance programs, and ISO/IEC 18974, the industry standard for open source security assurance programs.
Anchore provides software supply chain security tools, including Anchore Enterprise and the open source Syft and Grype projects (with over 50 million downloads). These tools help organizations generate and manage software bills of materials (SBOMs), scan for vulnerabilities, enforce policy, and validate compliance across CI/CD pipelines and production environments. Together, these capabilities support the processes the OpenChain standards expect organizations to have in place, including knowing which open source components are in their software, evaluating the risks and obligations attached to them, and keeping verifiable records.
“Open source is the foundation of modern software, and customers increasingly need to show, not just claim, that they manage it responsibly. Joining the OpenChain Partner Program lets us support organizations working toward those standards with SBOM and vulnerability management tooling they can use every day,” said Alex Rybak, Sr. Director, Product Management at Anchore.
Anchore serves both enterprises and government organizations that must meet demanding software supply chain security requirements. For federal customers, where SBOMs and demonstrable adherence to recognized standards increasingly shape how software is assessed and procured, the OpenChain standards offer a common benchmark that complements the tooling Anchore already provides. Anchore is referenced in both the U.S. Department of War (DoW) Container Image Creation and Deployment Guide and Container Hardening Process Guide.
About Anchore
Anchore empowers organizations to secure their software supply chains with speed and confidence. Anchore Enterprise delivers comprehensive SBOM management, industry-leading vulnerability management, and advanced policy enforcement for containers and beyond. By eliminating friction in software delivery and compliance, Anchore customers such as NVIDIA, Cisco, eBay, and government agencies, including the U.S. Department of War and U.S. Department of Homeland Security, ship software faster while meeting the most rigorous security and regulatory standards. For more information, visit https://www.anchore.com.
About the OpenChain Project
The OpenChain Project has an extensive global community of over 1,000 companies collaborating to make the supply chain quicker, more effective and more efficient. It maintains OpenChain ISO/IEC 5230, the international standard for open source license compliance programs, and OpenChain ISO/IEC 18974, the industry standard for open source security assurance programs.
About The Linux Foundation
The Linux Foundation is the world’s leading home for collaboration on open source software, hardware, standards, and data. Linux Foundation projects are critical to the world’s infrastructure, including Linux, Kubernetes, Node.js, ONAP, PyTorch, RISC-V, SPDX, OpenChain, and more. The Linux Foundation focuses on leveraging best practices and addressing the needs of contributors, users, and solution providers to create sustainable models for open collaboration. For more information, please visit us at linuxfoundation.org.
