Knowing What Risks Matter — And Don’t — In Your Open Source

The talk opens with the pressure developers face to ship quickly, and how open source components make that possible while widening the attack surface. The speaker points to software supply chain incidents such as SolarWinds and dependency confusion, and argues that heavier use of open source raises exposure. Telemetry gathered from thousands of applications frames the discussion.

The middle section walks through findings on library use. Only a small share of the code in a typical application is actually invoked, and many packaged libraries are never active. Libraries are often years old, and the likelihood of serious vulnerabilities rises as they age. The speaker says legacy software composition analysis tools produce many false positives, using a Log4j example where a library flagged on endpoints was never reached. Exposure is compared across Java, .NET and Node ecosystems, and licensing risk is covered, including copyleft and high-risk licenses.

The closing section proposes layering context on top of CVSS: whether a library is active, its age, whether vulnerable code is reachable, and exploit likelihood from EPSS and exploit-chatter trackers. Practitioners are advised to agree triage policies with developers, involve legal teams on licensing, and embed continuous checks in CI/CD so teams address the riskiest issues first.