--- title: Inside Platform Engineering with Nigel Douglas | daily.dev description: A conversation with Nigel Douglas, Head of Developer Relations at Cloudsmith, explores why teams struggle to track dependencies and avoid supply chain... canonical: https://daily.dev/posts/inside-platform-engineering-with-nigel-douglas-h7jxolffk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Inside Platform Engineering with Nigel Douglas | daily.dev og:description: A conversation with Nigel Douglas, Head of Developer Relations at Cloudsmith, explores why teams struggle to track dependencies and avoid supply chain... og:url: https://daily.dev/posts/inside-platform-engineering-with-nigel-douglas-h7jxolffk og:image: https://api.daily.dev/og/posts/H7jxOlFFk.png og:image:alt: Inside Platform Engineering with Nigel Douglas og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Inside Platform Engineering with Nigel Douglas **[OctopusDeploy](https://daily.dev/sources/octopusdeploy)** · 4 min read · 0 upvotes · 0 comments ## Summary A conversation with Nigel Douglas, Head of Developer Relations at Cloudsmith, explores why teams struggle to track dependencies and avoid supply chain compromises. Topics covered include transitive dependency risk, why attackers have shifted from ransomware to compromising widely-used packages for better return on effort, the value and limitations of SBOMs (using log4j as a case study), and why platform engineering teams, rather than security teams alone, are best positioned to own supply chain security by baking scanning tools and curated registries into golden paths. The discussion closes on AI accelerating both vulnerability discovery and attack capability, dubbed the 'vulnpocalypse.' ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why do SBOMs become outdated so quickly after being generated? An SBOM goes stale within hours because the dependencies it captures, and their own transitive dependencies, keep shifting underneath the application as builds happen and packages update. Generating an SBOM once is not the hard part; keeping it continuously accurate and stored somewhere queryable, such as Dependency-Track, is what makes it useful during an incident like log4j. _Track SBOM tooling and dependency-security practices as they evolve by following related coverage on daily.dev._ ### Why have supply chain attacks become more common than ransomware for attackers targeting software? Attackers are rational actors optimizing for return on effort: ransomware against a single company might not even get paid, while compromising one maintainer account on a package downloaded a hundred million times a month affects a massive number of downstream users for the same amount of work. This shift reflects a realization that supply chains offer far higher leverage at scale, not a new discovery of the attack surface itself. _Developers weighing dependency risk can keep up with supply chain attack trends via daily.dev._ ### Whose job should supply chain security be, the security team or the platform team? Platform engineering teams, not security teams alone, are best positioned to own supply chain security because they already control what goes into the build process and define the golden paths developers use. A CISO can set policy, but platform teams can bake in tools like OSV scanning at the edge or route developers through a curated package registry instead of pulling directly from the public internet. _Platform engineers deciding who owns dependency risk can follow this debate on daily.dev._ ## Similar posts on daily.dev - [Automaker Secures Supply Chain With Developer-Friendly Platform](https://daily.dev/posts/automaker-secures-supply-chain-with-developer-friendly-platform-w95boithk) · Dark Reading · 0 upvotes · 0 comments - [The Dependency Dilemma: Balancing Innovation Speed with Supply Chain Resilience](https://daily.dev/posts/the-dependency-dilemma-balancing-innovation-speed-with-supply-chain-resilience-iw1sarfuo) · JFrog · 0 upvotes · 0 comments - [You don’t know what you’re actually shipping](https://daily.dev/posts/you-don-t-know-what-you-re-actually-shipping-sitrszuhz) · All Things Open · 0 upvotes · 0 comments - [Cloudsmith Brings Threat Intelligence to Software Artifacts](https://daily.dev/posts/cloudsmith-brings-threat-intelligence-to-software-artifacts-lokb9anvc) · DevOps.com · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#platform-engineering](https://daily.dev/tags/platform-engineering), [#sbom](https://daily.dev/tags/sbom) [View this post on daily.dev](https://daily.dev/posts/inside-platform-engineering-with-nigel-douglas-h7jxolffk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Inside Platform Engineering with Nigel Douglas","url":"https://daily.dev/posts/inside-platform-engineering-with-nigel-douglas-h7jxolffk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/inside-platform-engineering-with-nigel-douglas-h7jxolffk"},"datePublished":"2026-08-21T10:24:33.689Z","dateModified":"2026-09-13T21:47:31.946Z","description":"A conversation with Nigel Douglas, Head of Developer Relations at Cloudsmith, explores why teams struggle to track dependencies and avoid supply chain...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/72786d24b7400fd34714ad55dfa7605b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/72786d24b7400fd34714ad55dfa7605b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"OctopusDeploy","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"OctopusDeploy","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/71110ae886d64eac9f3a01496feb2bd8","url":"https://daily.dev/sources/octopusdeploy"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/inside-platform-engineering-with-nigel-douglas-h7jxolffk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,platform-engineering,sbom","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"OctopusDeploy","item":"https://daily.dev/sources/octopusdeploy"},{"@type":"ListItem","position":3,"name":"Inside Platform Engineering with Nigel Douglas"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/inside-platform-engineering-with-nigel-douglas-h7jxolffk#faq","mainEntity":[{"@type":"Question","name":"Why do SBOMs become outdated so quickly after being generated?","acceptedAnswer":{"@type":"Answer","text":"An SBOM goes stale within hours because the dependencies it captures, and their own transitive dependencies, keep shifting underneath the application as builds happen and packages update. Generating an SBOM once is not the hard part; keeping it continuously accurate and stored somewhere queryable, such as Dependency-Track, is what makes it useful during an incident like log4j. Track SBOM tooling and dependency-security practices as they evolve by following related coverage on daily.dev."}},{"@type":"Question","name":"Why have supply chain attacks become more common than ransomware for attackers targeting software?","acceptedAnswer":{"@type":"Answer","text":"Attackers are rational actors optimizing for return on effort: ransomware against a single company might not even get paid, while compromising one maintainer account on a package downloaded a hundred million times a month affects a massive number of downstream users for the same amount of work. This shift reflects a realization that supply chains offer far higher leverage at scale, not a new discovery of the attack surface itself. Developers weighing dependency risk can keep up with supply chain attack trends via daily.dev."}},{"@type":"Question","name":"Whose job should supply chain security be, the security team or the platform team?","acceptedAnswer":{"@type":"Answer","text":"Platform engineering teams, not security teams alone, are best positioned to own supply chain security because they already control what goes into the build process and define the golden paths developers use. A CISO can set policy, but platform teams can bake in tools like OSV scanning at the edge or route developers through a curated package registry instead of pulling directly from the public internet. Platform engineers deciding who owns dependency risk can follow this debate on daily.dev."}}]} ```