Modern builds pull thousands of open-source packages straight from public registries, and attackers have learned to poison them at the source. In response, the ecosystem has reached a rare consensus in under a year: release cooldowns. npm, pnpm, and pip have all shipped waiting periods before newly published versions can be installed, and CISA now explicitly recommends a minimum release age.

But while the industry agrees on the control, almost no organization can actually enforce it consistently.

The Problem:

Client-side settings are voluntary, differ across ecosystems, and depend on every repository, CI image, and AI agent being provisioned correctly. At organisational scale, hoping "everyone remembered" is not a security control. Even where vendors have built real enforcement, it is often locked to a single platform. Meanwhile, attacks keep arriving through signed, trusted release paths, and compliance clocks like CRA Article 14 now demand rigorous evidence of exactly what entered your builds and when.

Why You Should Attend

Join Mitch Ashely of The Futurum Group and Thijs Feryn of Varnish for a practical session on solving this enforcement gap. We will show you how to turn the industry consensus on release cooldowns into an airtight, automated organisational policy that covers your entire infrastructure, including:

- Enforce a single, unified policy: Learn how to apply one set of rules across every ecosystem and client, closing the gaps left by fragmented, vendor-siloed tools.

- Roll out without breaking builds: Discover practical strategies for implementing package-age security controls smoothly, without disrupting your CI/CD pipelines.

- Automate your compliance trail: See how to capture the exact decision data needed to confidently answer the 72-hour reporting question and prove compliance with CRA Article 14.