Know your software supply chain

GUAC gives you directed, actionable insights into the security of your software supply chain.

Find out more Try it out

    GUAC is now an OpenSSF Incubating Project!

    The Graph for Understanding Artifact Composition (GUAC) maintainers are pleased to announce the project has joined the Open Source Security Foundation (OpenSSF) as an Incubating Project.

    Learn More

    How GUAC can help you

    These are just a few examples of insights that GUAC can give you to improve your software security posture

    Unveils gaps

  • Find the most used critical components in a software supply chain ecosystem
  • Track if all binaries in production trace back to a securely managed repository
  • Prevent supply chain compromises before they happen
  • Find exposures to risky dependencies
  • Compliance

  • Determine ownership of applications by organization
  • Look for evidence that the application you're about to deploy meets your organization's policies
  • Determine which application is missing SBOM or SLSA attestations
  • Conduct SBOM Diffs to quickly determine changes between versions
  • Threat Detection

  • Determine the blast radius of a bad package or a vulnerability and provide information and a patch plan towards remediation
  • Track a suspicious project lifecycle event back to when it was introduced
  • Obtain greater insight into vendor software vulnerabilities via VEX and project deprecation
  • In Open Source collaboration with



    Our Vision

    GUAC (Graph for Understanding Artifact Composition) aims to fill in the gaps by ingesting software metadata, like SBOMs, and mapping out relationships between software. When you know how one piece of software affects another, you’ll be able to fully understand your software security position and act as needed.

    What people are saying about GUAC!

    Hear what our community and partners have to say about GUAC!

    With the growing number of software supply chain security (SSCS) data, tools that allow us to find relevant information are crucial. Guac, providing graph representation of software packages, dependencies, vulnerabilities, attestations, etc. is a great tool for use cases in this domain. With mechanisms to ingest and certify data from various sources and GraphQL API to later query those data, we see it as a good foundation for our current and future SSCS efforts. Being a true open source initiative with a welcoming community is just a plus.
    Dejan Bosanac
    Engineer at Red Hat
    At Yahoo, we have found immense value and significant efficiency by utilizing the open source project GUAC. GUAC has allowed us to streamline our processes and increase efficiency in a way that was not possible before. It allows us to ingest large number of SBOMs and also provides an interface to visualize the current state of images & packages used at Yahoo in real time. We look forward to continuing to utilize GUAC and contribute to its growth in any way we can.
    Hemil Kadakia
    Sr. Mgr. Software Dev Engineering, Paranoids, Yahoo.
    As the CTO of ClearAlpha, I can't recommend GUAC enough for companies looking to boost their software security. GUAC's innovative approach to software supply chain security helps uncover hidden gaps and threats as we’re downloading dependencies and building apps, making it a perfect fit for our “solve it earlier” mindset at ClearAlpha. It also lines up with our commitment to transparency, open-source principles, and continuous learning. GUAC works well in teams practicing the rugged software manifesto, focusing on strong coding practices, constant testing, and automated tools to enhance security. Plus, its ability to trace risks back to their source aligns with our proactive risk awareness goals, enabling companies to spot and tackle potential issues early on. GUAC is just a fantastic tool to help any organization improve their software security with principles we all should value. If you're a tech founder, you'll definitely want to have GUAC on your team!
    Sean Terretta
    CTO at ClearAlpha
    GUAC came along as an open-source software at the right time helping us pivot away from building a bespoke solution and involving ourselves with the best minds behind the project. The value we see with GUAC is its flexibility and plugin architecture leading up to helping the users achieve compliance at different levels. The biggest benefit of GUAC has been producing it in the open with a widespread community behind it, from Google to Kusari and others. As the industry progresses, the threats to the software supply chain will become more complex, and relying on a tool backed by people with many years of experience in the area would make things easier for Guidewire to consume.
    Anoop Gopalakrishnan
    Vice President Of Engineering at Guidewire Software

    What's next?

    Learn more about GUAC

    Github Demos