Exclusive: Chainguard raises $140 million Series C (2024)

That’s what Chainguard CEO and cofounder Dan Lorenc once said, invoking Tolstoy’s Anna Karenina to explain his affinity for Hi-Dive, a dive bar on San Francisco’s Embarcadero. Walking into Hi-Dive feels vaguely like stepping into a submarine—the ceiling’s low, the water’s near, and the lights are dim or neon, even in the dead of a Friday afternoon.

“It’s my favorite place in San Francisco,” said Lorenc, who was at Google for nearly a decade and frequently brought colleagues to Hi-Dive, laptops in tow.

Now, Hi-Dive—with its faded blue floors and concrete umbrella-ed patio—is the unofficial Silicon Valley home of Chainguard, the software supply chain security startup that Lorenc cofounded in 2021 with now-CTO Matthew Moore, now-CPO Kim Lewandowski, and Ville Aikas. Though in certain ways a product of the pandemic—the company is fully remote, for example—Chainguard has seemingly jumped from COVID-19 into a full-fledged growth spurt. In the first six months of this fiscal year, Chainguard’s ARR has shot up by more than 175% and its customer base has grown by more than five times year over year.

I suspect you can see where this is headed: Chainguard recently raised a $140 million Series C, led by Redpoint, Lightspeed Venture Partners, and IVP, Fortune can exclusively report. Amplify, Mantis VC, Sequoia Capital, and Spark Capital, all existing investors, also participated in the round. The company’s now valued at $1.12 billion, but that valuation, Lorenc says, is a promise rather than an endpoint—from here, the task of scaling the company will be in full force.

“We haven’t won anything yet,” said Lorenc. “Our quarter’s about to end, and every quarter we start back over at zero.”

I met Lorenc and the Chainguard crew at the bar, with some folks joining virtually and engineering manager Priya Wadhwa (she’s worked for Lorenc three times) right next to me. They’re almost all sporting cowboy hats (more on that later), and recounting tales of karaoke triumphs and seafood boils.

“We do serious work, but we don’t take ourselves too seriously,” said Lewandowski. “That’s one of our core values.”

Okay, so what exactly is this “serious” work?

Here’s an attempt to sum it up in plain English: Most software today relies on open-source components called container images, which are the standard packaging format generally used to deploy software in the cloud. These container images require constant updating and vigilance to be secure. Chainguard manages this process, taking a real-world headache away from businesses while providing them with more confidence about their software’s security. In the words of Moore, the CTO, the company takes away the “toil” of removing vulnerabilities in base container images. This offsets the “doom cycle of iteration” that frequently kicks off when “developers discover numerous vulnerabilities,” Moore said.

Categorizing Chainguard (and its potential) isn’t necessarily easy. Sai Senthilkumar, Redpoint partner, said via email that Chainguard’s bull case is as a “next-gen” VMware, while the bear case is that it’s a complementary tool. On a Zoom call, Lightspeed partner Arsham Memarzadeh says that the firm initially struggled to put Chainguard in a bucket.

“We almost got caught up thinking: Oh, is this another supply chain security tool? But if you think about it, it is this supply chain, equal parts infrastructure company and cybersecurity company,” Memarzadeh said, who says that he thinks about Chainguard as a category-creator.

Exclusive: Chainguard raises $140 million Series C (2024)

References