Adapting Essential Eight for modern cloud environments using Chainguard

If software was eating the world in 2011, containerization has become the takeout box of choice in 2025. In 2024, a whopping 91% of organizations reported using containers for most or all of their production applications, with this shift to modern software development coinciding with a heavy reliance on open source artifacts, continuous integration, and automated deployment pipelines.

Unfortunately, this evolution unnecessarily expands the attack surface, particularly through the inclusion of unnecessary and unvetted modules in the software supply chain.

With the growth of open source software (OSS) and containerized environments, the need for a security framework that can handle modern application development pipelines has never been more critical, and regulatory frameworks are adapting to catch up.

How Essential Eight factors in

Essential Eight, initially developed by the Australian Cyber Security Centre (ACSC), is a required framework for securing government IT environments.  As the name implies, the framework defines eight (8) essential strategies to mitigate cybersecurity risks, which were designed to protect systems from common cyber threats, including malware, ransomware, and phishing.

The near ubiquity of cloud-native infrastructure necessitates adapting the often very Windows-oriented controls referenced in Essential Eight to the DevOps world. However, as organizations grapple with maintaining compliance in modern, cloud-native environments, it’s critical to minimize the engineering friction often associated with security.

The developer productivity challenge

A persistent pain point in modern DevOps and DevSecOps is the often negative impact of security issues on developer productivity.  That conflict between security needs and developer productivity often revolves around pausing feature development in favor of:

• Patching vulnerabilities

• Auditing open source software (OSS) packages

• Hardening and building images to create smaller attack surfaces

These demands create friction that slows innovation and diverts engineering time away from delivering business value. A Chainguard survey found that 74% of developers feel that security tools hinder productivity, and 77% feel that prioritizing software supply chain issues can lead to tension between the teams.

Chainguard addresses these challenges by offloading the OSS-related security tasks from the development team.  Chainguard allows developers to build secure applications without the overhead. For example:

• CVE patching: Chainguard rebuilds container images and libraries daily from source, fixing CVEs every day.  Developers no longer spend hours remediating vulnerabilities discovered by the security team.

• Signed SBOMs and supply chain attestation: Developers can confidently use OSS artifacts knowing every package is verified and auditable, reducing the need for manual checks.

• Minimal, distroless images: By eliminating unnecessary packages and shells, Chainguard reduces the attack surface while keeping container images lean, so developers don’t have to juggle security configurations.

By integrating security into CI/CD pipelines, Chainguard reduces the load on developers, ensures that security doesn’t become a bottleneck, and ensures development velocity.

Applying Essential Eight to cloud-native infrastructure with Chainguard

Below are the Essential Eight strategies along with some specific implementations of Chainguard that apply to those strategies:

Using Chainguard to implement Essential Eight principles transforms security from myopic, reactive CVE remediation, SBOM curation, and audit intelligence gathering into a proactive approach where both development and security teams have clear visibility into the state of their application infrastructure and compliance itself becomes an integral element of software development.

With continuous updates to eliminate CVEs, signed SBOMs that attest the correct, secure modules are in use, and the integrations in CI/CD pipelines, organizations benefit from:

• Reduced Risk due to smaller attack surfaces and faster CVE remediation.

• Enhanced Compliance: Real-time visibility and auditable evidence for regulators.

• Increased Developer Velocity: Engineers spend less time on triage and remediation of vulnerabilities and more time on business-critical development.

Chainguard operationalizes the Essential Eight principles through continuous monitoring, automated CVE management, and supply chain attestation, giving organizations the ability to secure modern infrastructure and increase developer productivity.

In today's environment of rising OSS attacks and regulatory scrutiny, leveraging trusted open source like Chainguard for continuous assurance is critical for reducing risk, meeting compliance obligations, and enabling teams to innovate efficiently. If this is you, reach out to our team to learn more about how we can help.