Vancouver company that builds open source components and container images from source, monitors them for vulnerabilities and republishes patched versions under remediation SLAs, delivering them to development teams through a private, policy-governed catalog.
Canadian innovation builds a brighter tomorrow.
Vancouver company that builds open source components and container images from source, monitors them for vulnerabilities and republishes patched versions under remediation SLAs, delivering them to development teams through a private, policy-governed catalog.
Positioned as a Niche Player in the 2026 Gartner Magic Quadrant for Software Supply Chain Security (company-announced). activestate.com
Its Curated Catalog won Best Open Source Security Platform at The Hacker News Cybersecurity Stars Awards 2026. activestate.com
In February 2026 said its library held 79 million built-from-source open source components across 12+ language ecosystems, with a 5-business-day remediation SLA for critical CVEs. activestate.com
Joined the Linux Foundation and the Open Source Security Foundation (OpenSSF) as a general member of both in 2026. activestate.com
Owned by Canadian private equity firm Vertu Capital, which announced its acquisition of Vancouver-based ActiveState on November 7, 2023. activestate.com
Products ActiveState publishes on its own site. Each card links to the page it was taken from.
Private source for vetted open source
A private package repository that serves only approved, policy-compliant open source components through pip, npm and artifact repositories such as JFrog Artifactory and Sonatype Nexus; components are built from source on SLSA Level 3 infrastructure, checked daily and rebuilt when fixed.
Learn moreHardened container images
Minimal container images for popular languages and open source apps, built from source on a distroless base without shells or package managers, rebuilt nightly, and shipped with SBOMs, signatures, VEX advisories and SLSA Level 3 provenance.
Learn morePublicly announced partnerships.
Joined Trivy Partner Connect (Nov 2025): ActiveState's CVE/VEX advisory feed and secure components are integrated into Trivy scans.
ActiveState announced that its Curated Catalog received the Best Open Source Security Platform award in the Open Source Security category of The Hacker News Cybersecurity Stars Awards 2026. The release describes the catalog as a private, policy-governed repository of built-from-source components with 5- and 10-business-day remediation SLAs for critical and high CVEs.
ActiveState announced it was positioned as a Niche Player in the 2026 Gartner Magic Quadrant for Software Supply Chain Security. It attributed the placement to building components from source in its own SLSA Level 3 infrastructure, contractual remediation SLAs, and signed SBOMs and VEX documents.
ActiveState announced its library of secure open source components had grown to 79 million across 12+ language ecosystems, including Java, JavaScript, Go, Python, R, Rust, PHP, .NET and C/C++, built from source in a SLSA Level 3 environment with a 5-business-day remediation SLA for critical CVEs.
Terms the company uses about its own work.
Other companies in Cybersecurity.
Discover companies, track funding, explore career opportunities and stay informed about Canada’s growing tech ecosystem.
