This talk discusses a JVM-native approach to securing the Java Software Supply Chain. A JVM-native approach eliminates false positives, introduces no extra work for anyone, and provides zero-overhead, continuous, code level Software Composition Analysis. It provides prioritization based on code that is actually used, and provides organizations with a continuous understanding of their Java workloads’ exposure to known vulnerabilities in all environments including Production.