--- title: "Inside Platform Engineering with Nigel Douglas" url: https://daily.dev/posts/inside-platform-engineering-with-nigel-douglas-h7jxolffk source_url: https://octopus.com/blog/inside-platform-engineering-nigel-douglas type: article source: "OctopusDeploy" published: 2026-08-21T10:24:33.689Z updated: 2026-08-21T10:25:02.535Z tags: ["security", "platform-engineering", "sbom"] reading_time: 4 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Inside Platform Engineering with Nigel Douglas **[OctopusDeploy](https://daily.dev/sources/octopusdeploy)** · 4 min read · 0 upvotes · 0 comments ## Summary A conversation with Nigel Douglas, Head of Developer Relations at Cloudsmith, explores why teams struggle to track dependencies and avoid supply chain compromises. Topics covered include transitive dependency risk, why attackers have shifted from ransomware to compromising widely-used packages for better return on effort, the value and limitations of SBOMs (using log4j as a case study), and why platform engineering teams, rather than security teams alone, are best positioned to own supply chain security by baking scanning tools and curated registries into golden paths. The discussion closes on AI accelerating both vulnerability discovery and attack capability, dubbed the 'vulnpocalypse.' ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why have supply chain attacks increased compared to ransomware in recent years? Attackers are rational actors optimizing return on effort: ransomware against a single company may not even result in payment, while compromising one maintainer account on a package downloaded a hundred million times a month affects far more targets for similar effort. Nation-state and organized groups have realized supply chains offer better scale for the same work, not that they only recently discovered them. _Teams weighing where to invest security effort can follow supply chain risk analysis like this on daily.dev._ ### Why is generating an SBOM not enough to manage software supply chain risk? An SBOM becomes stale within hours because dependencies and their own transitive dependencies keep shifting underneath a build, so the hard part is keeping it current, not generating it once. Capturing SBOMs at every build and storing them in a tool like Dependency-Track turns an incident like log4j into minutes of querying instead of hours of manual auditing across every application. _Anyone building an SBOM strategy can track practical dependency-tracking approaches on daily.dev._ ### Should platform teams or security teams own software supply chain security? Platform teams are better positioned to own it because they already control what goes into the build process and the golden paths developers use, while a CISO can only set policy without building those paths. This means baking in tools like OSV scanning at the edge or routing developers through a curated package registry falls naturally to platform engineering rather than a separate security team. _Platform engineers deciding who owns supply chain tooling can follow this debate on daily.dev._ ## Similar posts on daily.dev - [Automaker Secures Supply Chain With Developer-Friendly Platform](https://daily.dev/posts/automaker-secures-supply-chain-with-developer-friendly-platform-w95boithk) · Dark Reading · 0 upvotes · 0 comments - [The Security Imperative: Trust, Speed, and Integral Defense](https://daily.dev/posts/the-security-imperative-trust-speed-and-integral-defense-7p8uwa0cj) · JFrog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#platform-engineering](https://daily.dev/tags/platform-engineering), [#sbom](https://daily.dev/tags/sbom) [View this post on daily.dev](https://daily.dev/posts/inside-platform-engineering-with-nigel-douglas-h7jxolffk)