Firms are embracing Open Source. Securing it? Not so much.

Synopsys' 2020 OSSRA found open-source software in 99% of audited codebases, comprising about 70% of code; 75% of codebases contained at least one public vulnerability and roughly half contained high-risk vulnerabilities, averaging 82 vulnerabilities per codebase. The report highlights growth in open-source use, concentrated reuse of common components with known issues, and recommends building a software Bill of Materials (BOM), continuous monitoring, and not relying on a single vulnerability source to manage open-source security risk.