Kusari is a cybersecurity technology company located in the United States that specializes in software supply chain security. Founded by key co-creators and contributors to major open-source software security standards—including GUAC (Graph for Understanding Artifact Composition) and SLSA (Supply-chain Levels for Software Artifacts)—Kusari provides an enterprise security platform designed to analyze, map, and secure complex software dependencies.
Modern application development relies heavily on open-source libraries and third-party modules. While teams author a fraction of their application's codebase, up to 95% of software vulnerabilities hide within deep transitive dependencies—components introduced indirectly through other libraries. Kusari addresses this visibility gap by building a continuous intelligence layer, known as the Kusari Trust Fabric, which maps the entire software dependency graph and provides actionable risk intelligence, automated review, and autonomous remediation.
Core Architecture: The Kusari Trust Fabric
The foundation of Kusari’s technology is the Kusari Trust Fabric. Rather than relying solely on runtime checks or simple top-level package manifest scans, Kusari evaluates software directly from source, tracking provenance, deep transitive relationships, and build-time attestations.
The platform normalizes data from existing toolchains—such as Software Composition Analysis (SCA) tools, static analysis engines, CI/CD pipelines, and vulnerability databases like OSV and deps.dev—into a unified knowledge graph. By correlating these datasets, the Trust Fabric delivers:
Full Transitive Dependency Graphs: Multi-tiered mapping of dependencies beyond surface-level package configurations.
Reachability & Exploitability Analysis: contextual evaluation to determine whether vulnerable code paths are actually reachable within the application execution context.
Kusari Score: A prioritized risk scoring model that combines raw CVSS severity with reachability, blast radius, and real-world exploitability to eliminate alert noise.
Continuous Audit & Compliance: Real-time generation of normalized Software Bill of Materials (SBOMs) in standard formats such as CycloneDX and SPDX, alongside VEX (Vulnerability Exploitability eXchange) documents.
Products and Services
Kusari offers an integrated suite of products and services tailored for security engineering teams, software developers, and executive security leadership.
1. Kusari Platform (Command and Control Center)
The flagship enterprise management solution acts as the central software supply chain command and control center. It offers full visualization of an organization's software estate, allowing security leaders to perform dependency searches, trace artifact provenance, track historical compliance, and evaluate overall software risk profiles across microservices and enterprise applications.
Kusari Inspector embeds software supply chain security directly into continuous integration and version control workflows (e.g., GitHub, GitLab, Bitbucket, Azure DevOps, Jenkins, CircleCI).
* Pull Request Governance: Automatically reviews pull requests and provides blocking or non-blocking security checks prior to code merge.
* Environment-Aware Guidance: Evaluates proposed dependency changes against full transitive trees and provides precise remediation suggestions without causing downstream build breaks.
* Frictionless Developer Workflow: Functions directly within standard developer tools, code review interfaces, and IDEs to prevent security context-switching.
3. Kusari Agent (AI-Driven Estate Querying)
An enterprise AI engine built upon Model Context Protocol (MCP) standards that allows security operations and incident response teams to interrogate their entire software graph using natural language.
* Rapid Incident Response: Enables zero-lag queries during zero-day disclosure events (e.g., querying whether specific vulnerable libraries or compromised package versions exist across any production service).
* Blast-Radius Mapping: Instantly maps exposed services, pinpoints code maintainers, and generates contextual routes for operational teams.
* Automated Ticketing & Alerts: Connects with operational platforms such as Jira, ServiceNow, Slack, and Microsoft Teams.
4. Kusari AutoFix (Autonomous Remediation)
An automated AI remediation system designed to handle dependency patching and vulnerability fixing safely.
* Root-Cause Analysis: Traces vulnerability findings down to the specific root package or transitive child node.
* Contextual PR Generation: Constructs and tests working code updates that respect existing codebase constraints and environment rules before submitting pull requests for developer approval.
Open Source Leadership and Regulatory Compliance
Open Source Foundations
Kusari’s architecture leverages open-source standards co-developed by its founding team in partnership with industry bodies such as the Open Source Security Foundation (OpenSSF):
* GUAC (Graph for Understanding Artifact Composition): An OpenSSF incubating project co-created with Google to aggregate and query software security metadata.
* SLSA (Supply-chain Levels for Software Artifacts): An end-to-end framework for supply-chain integrity co-authored alongside Google.
* In-Toto & OpenSSF Scorecard: Active technical contributions toward attestation standards and baseline open-source risk scoring.
Regulatory Readiness
The platform assists organizations in meeting stringent global regulatory frameworks and supply chain compliance mandates, including:
* EU Cyber Resilience Act (CRA)
* Executive Order 14028 / NIST Software Supply Chain Development Framework (SSDF)
* FDA Section 524B (Medical Device Cybersecurity)
* Digital Operational Resilience Act (DORA)
* FedRAMP, PCI DSS, SOC 2, and CMMC 2.0
Please note: This information is generated by AI. For legal use, verify with company sources.
