open source security

OpenSSF Expands AI Security Resources for Open Source | ECI Research

OpenSSF Expands AI Security Resources for Open Source | ECI Research

AI, Application Development, DevSecOps, Events, KubeCon + CloudNativeCon NA 2026 /

OpenSSF announced new members, a developer guide to AI-assisted vulnerability management, a new SAIA certification, and expanded malicious package coverage across eight ecosystems. The moves address a structural gap between AI-accelerated code production and security teams’ ability to keep pace. ECI Research analysis explains what it means for government and enterprise ITDMs and developers.

OpenSSF Expands AI Security Resources for Open Source | ECI Research Read More »

Chainguard Athena: Fixing AI-Accelerated Vulnerabilities at Scale

Chainguard Athena: Fixing AI-Accelerated Vulnerabilities at Scale

Application Development, DevSecOps, Open Source, Supply Chain /

Chainguard has launched Athena, an industry coalition designed to close the gap between AI-accelerated vulnerability discovery and actual remediation. With 1 billion container build manifests processed, Chainguard has the scale to back its ambitions. ECI Research data reveals why inconsistent SBOM practices and compliance friction make this problem harder than it looks.

Chainguard Athena: Fixing AI-Accelerated Vulnerabilities at Scale Read More »

Open Source Summit Europe 2026: Sovereignty, Security & AI Governance

Open Source Summit Europe 2026 Wrap-Up

Cyber Security, Enterprise Software, Open Source, Open Source Summit Europe 2026 /

Open Source Summit Europe 2026 made one thing clear: open source is now a strategic foundation for enterprise AI, digital sovereignty, and software supply chain security. The challenge is that the ecosystem is innovating faster than most organizations can govern it. ECI Research examines what that means for ITDMs and developers heading into 2027.

Open Source Summit Europe 2026 Wrap-Up Read More »

FINOS OSERA: Backport Patching for Financial Services Security

FINOS OSERA: Backport Patching for Financial Services Security

Application Development, Cyber Security, Events, FinOps, Open Source, Open Source Summit Europe 2026 /

FINOS has launched OSERA, a platform that backports security patches to the legacy open-source dependency versions large banks are actually running. Paired with a new set of remediation standards agreed upon by member institutions, OSERA addresses the gap between upstream security fixes and production reality in regulated environments. AI-enabled threat capabilities are widening that gap faster than traditional patch cycles can close it.

FINOS OSERA: Backport Patching for Financial Services Security Read More »

CRA Compliance, AI Security, and Open Source Sovereignty | ECI Research

CRA Compliance, AI Security, and Open Source Sovereignty | ECI Research

AI, Application Development, Compliance, Cyber Security, Events, Open Source, Open Source Summit Europe 2026 /

OpenSSF leadership and Linux Foundation policy panelists at Open Source Summit Europe 2026 converged on three urgent themes: CRA compliance readiness is dangerously low, AI-assisted development is outpacing security governance, and Europe’s open source sovereignty gap is a services problem, not a software problem. ECI Research overlays survey data to show what this means for ITDMs and developers navigating regulated environments.

CRA Compliance, AI Security, and Open Source Sovereignty | ECI Research Read More »

OpenSSF, AWS, and the New Stakes of Open Source Security Compliance

OpenSSF, AWS, and the New Stakes of Open Source Security Compliance

Application Development, Compliance, Cyber Security, Events, Infrastructure, Open Source, Open Source Summit Europe 2026 /

OpenSSF announced four new members and a suite of EU Cyber Resilience Act readiness resources at Community Day Europe, while AWS elevated to Platinum membership at the Linux Foundation. Together, the moves signal enterprise consolidation around open source security governance as CRA enforcement begins and AI accelerates vulnerability discovery. ECI Research data shows significant gaps between compliance mandates and operational readiness that these initiatives directly address.

OpenSSF, AWS, and the New Stakes of Open Source Security Compliance Read More »

AI Is Breaking Open Source Trust — And Provenance Is the Fix

AI Is Breaking Open Source Trust — And Provenance Is the Fix

AI, Application Development, Open Source /

AI-accelerated development is flooding open source maintainers with unreviewed pull requests while cryptographic signing and SBOM adoption remain dangerously low. Timothy Lewis of tea.inc. argues that provenance and identity are the missing foundations of enterprise software supply chain security. ECI Research data shows that AI-generated package risk is now the top open-source security concern for 2026.

AI Is Breaking Open Source Trust — And Provenance Is the Fix Read More »

Open Secure AI Alliance Joins Linux Foundation: AI Security Governance Gets a Neutral Home

Open Secure AI Alliance Joins Linux Foundation

AI, Application Development, Cyber Security, Machine Learning /

The Linux Foundation has assumed stewardship of the Open Secure AI Alliance, originally founded by NVIDIA, establishing a vendor-neutral home for open AI security standards and the Shared AI Findings Exchange. For government agencies and regulated enterprises, the move lowers participation barriers and signals that AI security governance is maturing into a formal compliance discipline. ECI Research data shows compliance friction remains the top blocker for AI adoption in federal developer workflows.

Open Secure AI Alliance Joins Linux Foundation Read More »

Broadcom Tanzu Platform: Governed AI Agents for Private Cloud

Broadcom Tanzu Platform: Governed AI Agents for Private Cloud

AI, Application Development, Cloud, Enterprise Software, Infrastructure, Machine Learning, VMware Explore /

Broadcom announced AI-ready data foundations for the VMware Tanzu Platform at VMware Explore 2026, pairing hardened agent sandboxes with governed data access inside private clouds. Separately, TrueSource delivers human-verified, commercially supported open source libraries across Java, Python, and Node.js. Together, the announcements signal Broadcom’s bid to own the governed AI agent runtime for regulated enterprises.

Broadcom Tanzu Platform: Governed AI Agents for Private Cloud Read More »

Echo Acquires Minimus: Secure-by-Default Market Consolidates

Echo Acquires Minimus: Secure-by-Default Market Consolidates

Application Development, Cloud, Infrastructure, Marketing Strategy, Security /

Echo has acquired key technology assets from Minimus, positioning itself as the first distro-agnostic, secure-by-default software platform. The deal signals market consolidation around two players: Echo and Chainguard. ECI Research data on open source validation and AI compliance friction reveals why this category matters now.

Echo Acquires Minimus: Secure-by-Default Market Consolidates Read More »