In 2026 alone, attackers poisoned axios, forged provenance for 42 TanStack packages, and sent a worm through keyv. The industry's response is clear: block bad packages at the gate, before they download. Even JFrog is following suit, retiring Xray's Block Download feature by November 2026 in favor of Curation, a separately licensed product.

Gate enforcement is now table stakes. What decides whether it works is who owns your security policy, and where it runs. Many organizations run a mix of registries like Artifactory, Nexus, and GitHub Packages, so a policy tied to one platform leaves the rest less protected. And with AI agents installing dependencies faster than any human can review them, your policy needs to be one you can change in seconds.

Join Mitch Ashley of The Futurum Group and Thijs Feryn of Varnish for a practical session on taking control of package enforcement. We'll show you how to turn gate enforcement into an automated policy you own, across your entire infrastructure.

In this webinar, you’ll learn how to:

• Own your policy: Keep rules as code in Git and apply one policy across every registry

  you run.

• Enforce without a cloud dependency: Block packages before download, with no round

  trip to a vendor API.

• Roll out without breaking builds: Quarantine new releases, resolve to the latest safe

  version, and test in report-only mode first.

• Catch attacks before the CVE: Feed community intelligence from OSV.dev straight into

  Enforcement.

Facing an Xray renewal or rethinking your stack? Join us live.