Chainguard, the US software supply chain security company, has committed $200m to its Europe, Middle East and Africa business and chosen Clerkenwell in London as its regional headquarters. The firm says it will add 200 roles across the region, a bet that buyers will pay to stop vulnerable open source code reaching production in the first place.
What happened
On 20 October 2026 Chainguard announced what it describes as continued, multi-year investment of $200m across EMEA. The centrepiece is a new office at 3 Herbal Hill, Clerkenwell, which will act as the company’s EMEA hub. Alongside it, the firm plans 200 new positions spanning engineering, sales and customer success.
The business already has close to 70 people in the UK, and the London office is intended as a base for them and a venue for clients, partners and open source contributors. Chainguard is remote-first, so the office is a meeting point rather than a daily destination.
City AM reports that the company is valued at $3.5bn and counts Sequoia Capital, Lightspeed and General Catalyst among its backers.
The regional push is being led by Ian Burley, appointed Group Vice President for EMEA earlier this year after some 20 years in B2B software at firms including Benchling, Snowflake and BMC Software. Burley framed the case bluntly, likening unvetted downloads from public registries to “picking a USB stick up off the pavement” before using it.
The detail
Chainguard says it first set up in EMEA in October 2023. Over the past 12 months it claims regional annual recurring revenue has grown by more than 400% and that its EMEA customer count has risen by 800%. Globally it reports more than 800 customers, and named European clients include Siemens, Aleph Alpha, Cato Networks and the shipping group Hapag-Lloyd.
Those growth percentages deserve a little caution. As the London Business Journal points out, Chainguard has not published the underlying revenue or the starting number of regional customers, so there is no way to judge the absolute scale. The same outlet also notes that the $200m is a multi-year commitment across the whole region rather than money being spent in London straight away, and that the company has not said how many of the 200 roles will sit in Britain or when they will be filled.
The commercial pitch is straightforward. Chainguard cites research putting open source at over 90% of a typical modern codebase, and very little of it is written by the organisation that ships it. Chainguard sells hardened, minimal container images and software components designed to carry as few known vulnerabilities as possible, so engineering teams consume a curated version rather than whatever happens to be on a public registry that day.
The company argues that frontier AI models now find dormant flaws in those dependencies and link together low and medium severity bugs into working exploits within hours. Its conclusion is that reactive patching cannot keep pace and that prevention is the only approach that scales.
Why it matters for UK organisations
For the UK security market, this is another vote of confidence in London as the base from which international vendors serve European buyers. City AM places it alongside a run of recent US technology commitments to British AI and cyber security, and against a backdrop of disruptive attacks on UK retailers that have made boards far more attentive to resilience spending.
The regulatory angle is the one I would pay closest attention to. Chainguard explicitly ties its offer to DORA, NIS2, PCI DSS and the EU Cyber Resilience Act. UK financial firms with EU operations already live with DORA, and any UK manufacturer or software house selling products with digital elements into the EU single market will fall within scope of the Cyber Resilience Act. Domestically, the Cyber Security and Resilience Bill is expected to put more weight on supply chain assurance for operators of essential services and their key suppliers. Each of these regimes pushes organisations to show, with evidence, where their software comes from and how it is maintained.
A well-funded vendor hiring locally also matters for the skills market. Two hundred roles across EMEA is not transformative on its own, but competition for experienced platform and application security engineers in London is already intense, and every new entrant pushes salaries and expectations upwards.
Expert view
When we test modern application estates, the container layer is routinely where the noise lives. Scanners return hundreds of findings against base images, most of them in packages the application never actually uses, and teams either drown in tickets or quietly stop reading the reports. Shrinking the base image and starting from a known-clean build genuinely reduces that problem.
What I would caution against is treating any curated image catalogue as a complete answer to supply chain risk. It addresses known vulnerabilities in third-party components. It does not fix weak build pipelines, leaked CI/CD secrets, over-privileged service accounts or the logic bugs in bespoke code that we find on most engagements. In my experience, the organisations that get real value from these products are the ones that already know what software they run, because they can measure the improvement.
The AI framing is partly marketing, but the direction of travel is real. If vulnerability discovery is getting cheaper for attackers, the window between a flaw becoming known and being exploited shrinks, and long patch backlogs become harder to justify to an auditor or an insurer.
What to do now
- Build a software bill of materials. Know which open source components, container images and versions are running in production before you buy anything.
- Control where packages come from. Route builds through an internal registry or proxy rather than pulling directly from public sources. This supports the Cyber Essentials secure configuration and security update management controls.
- Minimise base images. Strip shells, compilers and unused libraries from production containers.
- Set patching targets you can meet. Cyber Essentials expects high and critical fixes within 14 days. Measure your real performance against that, including for container images.
- Harden the pipeline. Review CI/CD permissions, secrets handling and build signing, which a clean image alone does not address.
- Map regulatory exposure. Check whether DORA, NIS2, the Cyber Resilience Act or the forthcoming UK legislation applies to you or your customers, and what supply chain evidence each will require.
- Test vendor claims. If evaluating hardened image providers, run a proof of concept against your own workloads and compare scanner output before and after.
Bottom line
Chainguard’s London headquarters and $200m pledge are a clear signal that software supply chain security has become a serious commercial category, and that UK and European regulation is creating demand for it. The headline growth figures lack a baseline and the jobs are spread across EMEA, so the immediate UK impact is modest. For security leaders, the more useful takeaway is the pressure behind the deal: know your dependencies, control their source and be ready to prove it.
Sources
- PR Newswire: Chainguard Commits $200 Million to Help EMEA Organisations Prevent AI Attacks
- City AM: US cybersecurity startup bets $200m on London expansion
- BusinessCloud: $3.5bn cyber firm opens UK HQ amid $200m pledge
- The London Business Journal: Chainguard Announces $200m EMEA Investment and London Hub
