# Kusari

> The software supply chain security platform that shows you exactly what's exploitable in your code and ships the fix. Built from source for a complete, provable dependency graph, by the team that co-created the GUAC, SLSA, and in-toto open standards.

## Product

- [Kusari Platform](https://www.kusari.dev/platform/): Command center for supply chain risk. Full transitive graph, reachability, exploitability, and the Kusari Score.
- [Kusari Inspector](https://www.kusari.dev/inspector/): Free autonomous security reviewer in every pull request. Thumbs up or down before code reaches main.
- [Integrations](https://www.kusari.dev/integrations/): Works as the intelligence layer above your existing stack. GitHub, GitLab, Black Duck, Jira, and more.
- [Documentation](https://docs.kusari.cloud): Product docs, setup guides, and API reference.
- [Request a demo](https://www.kusari.dev/demo/): 30-minute walkthrough of the platform against a codebase like yours.

## Why Kusari

- [About Kusari](https://www.kusari.dev/about/): Founded by engineering leaders from finance and government defense who lived the pain of shipping secure software on deadline.
- [Leaders in Open Source](https://www.kusari.dev/open-source/): Founders co-created the open standards now used to secure the industry's supply chains.

## Key concepts

- [The 95% problem: transitive dependencies](https://www.kusari.dev/blog/why-transitive-dependencies-biggest-software-supply-chain-blind-spot-2026/): Why standard scanners see only 5% of your real risk.
- [The transitive dependency visibility gap](https://www.kusari.dev/blog/why-72-of-organizations-cant-see-their-real-attack-surface-solving-the-transitive-dependency-visibility-gap/): Why 72% of orgs can't see their real attack surface.
- [Unpacking the Kusari Score](https://www.kusari.dev/blog/kusari-score/): One actionable number from reachability, exploitability, and blast radius, not raw CVSS.
- [Reachability and exploitability analysis](https://www.kusari.dev/blog/improving-vulnerability-reachability-and-exploitability-analysis/): How Kusari traces which vulnerabilities can actually be reached, and writes the VEX.
- [Best SBOM tools](https://www.kusari.dev/blog/best-sbom-tools-2025/): Comparison of SBOM generation tools and how to choose one.

## Regulatory

- [EU Cyber Resilience Act guide](https://www.kusari.dev/blog/why-the-eu-cyber-resilience-act-will-catch-us-software-companies-off-guard/): Why the EU CRA will catch US software companies off guard.
- [Facts and Mythos](https://www.kusari.dev/blog/facts-and-mythos/): What AI-driven vulnerability discovery does and doesn't change for security teams.

## More

- [Blog](https://www.kusari.dev/blog/): Research, product launches, and field notes on software supply chain security.
- [Whitepapers](https://www.kusari.dev/resources/whitepapers/): In-depth technical and strategic guides.
- [Contact](https://www.kusari.dev/contact/): Get in touch with the team.