ActiveState Software Inc. is a Canadian software company that develops and supports tools for managing open source software in enterprise environments. The company provides solutions for automated vulnerability management, container security, and supply chain security. ActiveState delivers secure containers and language runtimes that development teams can incorporate into their software development lifecycle (SDLC). Its platform provides tools for managing vulnerabilities and dependencies in open source components across multiple programming languages.
As of 2025, ActiveState reports serving approximately 94,000 monthly active users and supporting more than 40 million open source libraries. The company states that its platform is compliant with the National Institute of Standards and Technology (NIST) Secure Software Development Framework (SSDF).
ActiveState is privately held and jointly owned by its employees and Vertu Capital, a Canadian private equity firm.
History
ActiveState Software Inc. was founded in 1997 in Vancouver, British Columbia, Canada, by Dick Hardt, David Ascher, and others, with the goal of adapting open source programming languages for commercial use. The company became known for commercial distributions of languages such as Perl, Python, and Tcl for Windows and enterprise platforms.
In 2003, the company was acquired by British security software firm Sophos, a UK-based security software company, and operated as a wholly owned subsidiary. In January 2006, ActiveState was purchased by Pender Financial Group, a Canadian investment company.
In early 2021, ActiveState received a strategic investment from Turn/River Capital, a San Francisco-based private equity firm. On November 7, 2023, the company was acquired by Vertu Capital, a Canadian private equity firm, and became jointly owned by Vertu Capital and ActiveState employees.
Subsidiaries
Phenona: In June 2011, ActiveState Software Inc. announced the acquisition of Phenona.
Appsecute Limited: In June 2013, ActiveState Software Inc. announced the acquisition of Appsecute. The acquisition would become ActiveState's strategy to pair Appsecute with Stackato.
Products
ActiveState platform overview
The ActiveState Platform is a cloud-based platform for building, managing, and securing open source software components across multiple programming languages. It compiles packages from source code, implements the SLSA security framework, and includes vulnerability detection tools.
The platform is delivered as a managed service in which ActiveState oversees the building, updating, and maintenance of open source components on behalf of its users. It can generate secure container images, manage dependencies, and create software bills of materials (SBOMs) in SPDX and CycloneDX formats. In this model, ActiveState handles security patching, compliance, and dependency updates on behalf of its users.
Secure containers
In 2024, ActiveState introduced Secure Containers, a set of prebuilt container images designed to ship without known vulnerabilities. The images are rebuilt nightly with signed SBOMs and attestations, and critical security vulnerabilities are remediated within seven days.
Secure Containers are distributed through Docker Hub and are available for languages including Python, Java, Node.js, Go, .NET Core, Rust, Perl, PHP, and for common utilities such as curl, wget, and bash. A static base image is also available. Customers can request customization of a non-production container for evaluation purposes.
State tool
The State Tool is a command-line utility included with the ActiveState Platform. It allows users to manage programming language runtimes and dependencies, create and share reproducible development environments, and integrate ActiveState's services into automated build and deployment workflows.
The tool is also used for managing Python projects and environments, including creating isolated development setups and handling package installation from source.
Language distributions
ActiveState continues to offer commercial distributions of programming languages, which are integrated into the ActiveState Platform. These include:
Python distribution for multiple operating systems.
Go distribution for building cloud-native and system-level applications.
Java distribution for general-purpose and enterprise development.
R distribution for statistical computing and data analysis.
These distributions were among the company's first products and remain part of its core offerings.
Former products
ActiveState has developed several products that have since been discontinued or transferred:
Komodo IDE and Komodo Edit: Source code editors for dynamic and web languages. In 2021, ActiveState released Komodo IDE as open source software.
Stackato: A platform-as-a-service (PaaS) product based on Cloud Foundry. Hewlett Packard acquired Stackato in 2015.
Perl Dev Kit (PDK) and Tcl Dev Kit (TDK): Toolkits for application development in Perl and Tcl, respectively, which have been discontinued.
Enterprise CI/CD
ActiveState confirmed that its Enterprise CI / CD Survey is available for participation by 2020. Based on how businesses commonly utilize CI / CD and how they address software runtime and create issues, the study is part of ActiveState's ongoing initiatives to promote the development of open-source technology.
ActiveState has participated in industry webinars and podcasts on software supply chain security and related topics. The company has collaborated with technology media platforms including TechStrong TV, where executives and technical staff have discussed subjects ranging from balancing security with development speed to addressing technical debt.
Notable appearances include:
From Vulnerable to Unbreakable: Container Security for Open Source Simplified — A webinar exploring the advantages and risks of using open source in containers.
Streamlined Open Source: Innovation Without Bottlenecks — a microwebinar series on managing open source dependencies in enterprise environments.
ActiveState also publishes content on its own channels, including blogs, videos, and white papers, and has partnered with distributors such as Carahsoft and Aquion to deliver its solutions to government agencies and independent software vendors.
In 2025, ActiveState was recognized by ComponentSource in its annual awards as a "Top Global Innovator" and a bestselling publisher. The company had previously been named a "Top 25 Publisher" by ComponentSource in 2021.
ActiveState executives have also received individual recognition. In 2024, Chief Executive Officer Stephen Baker was named among the "Top 50 Software CEOs" by The Software Report. In the same year, Chief Marketing Officer Allyson Barr was included in the publication's list of "Top 50 Women Leaders in Software."
