Open Source Security in 2024: A Look at the Numbers
For nearly a decade, the “Open Source Security and Risk Analysis” (OSSRA) report has posed a critical question: “Do you know what’s in your code?” In 2024, this question is more crucial than ever. The use of third-party and AI-generated code has surged, making it essential to understand the security implications and potential risks of external contributions. Without this knowledge, organisations are vulnerable to security breaches and compliance issues.
The report offers a detailed analysis, drawing from over 1,000 commercial codebases audited in 2023. It provides a comprehensive view of the current landscape, covering security, compliance, licensing, and code quality risks in commercial software. The findings aim to guide security, legal, risk, and development teams in navigating this complex terrain.
One key finding of the OSSRA report is the overwhelming presence of community-driven code in today’s software. This prevalence highlights the urgent need for effective management of these components. The report reveals that 96% of the analysed codebases contained such code, with 77% of all source code originating from it. Astonishingly, the average application contained 526 individual components.
The 2024 OSSRA report is a stark reminder of the importance of proactive management in today’s software development. To gain a deeper understanding of these findings and recommendations, download the full 2024 OSSRA report.
Black Duck (SCA) Brochure | Application Security Solutions | Contact us
Sign up for our newsletter | Synposys
