The Trivy incident is a good reminder that supply chain attacks are as much an incident response problem as a security one. You can harden your pipeline, but when something slips through, the question becomes: how fast can you reconstruct what actually happened and what was touched? That's the problem we work on at Anyshift. I'm Valentine, ML/Data background, now Founding GTM there. We build causal reasoning over production and infra data so when things break (or get quietly compromised), you're not stitching together logs and timeline manually. https://www.anyshift.io/ Curious how people here handle post-compromise investigation, any tooling beyond the usual SIEM + log grep?