swampUP 2026: JFrog's Conference Puts AI Supply Chain Trust at the Center
Enterprise Developer PlatformsJFrog’s annual practitioner conference is centering its 2026 agenda on the question that keeps platform security teams awake: who — or what — is allowed to commit to your software supply chain, and how do you verify it?
What Happened
swampUP 2026 runs September 1–3 in New York City. The conference covers DevOps, DevSecOps, platform engineering, AI, and DevGovOps disciplines, with the 2026 theme organized around three operational questions for agentic supply chains: Immunize, Heal, and Govern.
The speaker lineup includes Jason Clinton (Anthropic Deputy CISO) on rethinking security for agentic development, Tim Brown (Team8 Partner, former SolarWinds CISO) on supply chain resilience, and panels with leaders from Chainguard, NVIDIA, AWS, Wiz, Red Hat, Moderne, and Echo. JFrog co-founder and CTO Yoav Landman presents the architecture-first approach.
Why It Matters
The three-pillar framework the conference is built around is more actionable than the usual practitioner conference theme:
Immunize — The premise is that the supply chain is bidirectional for AI agents: agents consume packages, models, and MCP servers, and they produce code and configurations. Both directions need validation. An AI agent installing an unverified MCP server is the same class of risk as a developer installing a typosquatted npm package.
Heal — Self-healing supply chains that detect and remediate vulnerabilities autonomously, matching the speed at which AI agents introduce new dependencies. The manual patch cycle breaks down when agents are adding dependencies faster than security teams can review them.
Govern — Governance embedded throughout the release lifecycle rather than at a final gate. For pipelines running at machine speed, a compliance review at the end of the sprint is already too late.
The presence of Anthropic’s Deputy CISO on the agenda is significant context. Anthropic isn’t a traditional enterprise software vendor — its appearance at a practitioner conference focused on supply chain tooling signals that the conversation between AI platform providers and enterprise security teams is moving from theoretical risk assessment to practical implementation guidance.
What This Means for Platform Engineers
swampUP has historically been the venue where JFrog announces product direction for the following 12 months. The 2026 theme — agentic supply chain trust — implies product investments in MCP server validation, AI-generated artifact provenance, and automated remediation workflows. For Artifactory, Xray, and JFrog Security users, this is the preview of what the platform’s security layer will look like when AI development tooling is treated as a first-class threat surface rather than an add-on concern.
For platform security teams evaluating this space, JFrog’s existing MCP tools and AI agent capabilities provides context for the infrastructure that the swampUP announcements are likely to extend.
September 1 is Training Day, covering governance, automation, and compliance implementation for practitioners who want hands-on context before the main conference sessions.
The So What
swampUP 2026 is running the right agenda for the current moment: the software supply chain problem that already existed is being compounded by agentic development patterns that human governance frameworks were not designed to handle. Whether you’re attending or tracking from the sidelines, the framework of Immunize/Heal/Govern provides a practical mental model for evaluating where an organization’s current supply chain posture has gaps — and where JFrog is betting its platform roadmap will matter most in 2026–2027.
Source: JFrog Blog
Content created with AI assistance and reviewed for accuracy.
Join the conversation
Stack Insiders is our free community for readers who want to go deeper — share resources, ask questions, and connect with others across every vertical we cover.
Join Stack Insiders →