ITASCA, Ill., Feb. 14, 2022 (GLOBE NEWSWIRE) -- Revenera, producer of leading solutions that help technology companies build better products, accelerate time to value and monetize what matters, today released the Revenera 2022 State of the Software Supply Chain Report, including research and six steps to better secure the software supply chain. This report helps security, software development, and legal experts benchmark their own efforts against market trends.
The Revenera report analyzes data from more than 100 open source audit projects conducted in 2021, identifying trends related to companies’ use of open source software (OSS) and their awareness of the associated license compliance and security risks. This global, cross-industry study evaluated more than 2.6 billion lines of code and found that companies are only aware of 17 percent of the open source components they use, a 4 percent increase in the past year.
Given that open source use is on the rise, along with the imposed operational risks and growing need for transparency and an SBOM, adoption of Software Composition Analysis (SCA) tools is expected to steadily go up. SCA identifies open source components and provides warnings regarding license terms and security vulnerability exposures—helping organizations to shore up potential blind spots in their software supply chain.
“Companies have realized they need to secure the software supply chain, which is under attack—as evidenced through vulnerabilities such as Log4Shell. All indications say bad actors are going to step up their exploits in the coming year,” said Alex Rybak, Director, Product Management, Revenera. “The use of third-party content and open source software will continue to increase. Organizations that invest in company-wide policies, continuous assessment, Software Composition Analysis solutions, and corporate compliance programs are best able to quickly respond to risks and customer requests.”
Key highlights of the Revenera 2022 State of the Software Supply Chain Report:
- Issues at all priority levels are growing: The number of the most severe issues, priority level P1, grew 6 percent over last year’s findings. Lower priority issues, however, surged: secondary priority issues (P2) and the lowest risk (P3) issues grew by 50 percent and 34 percent, respectively, over the past year. This indicates the growing prevalence of OSS and that the average number of dependencies is significantly increasing in popular ecosystems, broadening the plane for risk.
- Demands for SBOM are growing: Demand for SBOMs was driven by a broadening array of stakeholders and regulatory requirements, such as the U.S. government’s Executive Order on Improving the Nation’s Cybersecurity. The approach to building SBOMs is improving with automated, collaborative, and dynamic processes and as formats for creating and sharing SBOMs—SPDX, CycloneDX, and SWID—become standard.
- SBOM items increased: The Revenera audit team identified 12 percent more items in 2021 (over prior year) with 2,200 uncovered per audit project compared to 1,959 in 2020. Additionally, Revenera discovered a new issue for every 11,500 lines of code analyzed—a 5 percent increase compared to 2020.
- More binaries: Compared to source code, binaries are more complex, often combining IP from multiple sources and using many constituent files. This report found a 7 percent increase in binaries compared to 2020.
- M&A activity drove more SCA audits: M&A activity drove demand for complete risk profiles, forensic reports, and remediation assessments.
Resources
- Report: Revenera 2022 State of the Software Supply Chain Report
- Blog: The FTC’s warning to companies about the failure to protect against open source vulnerabilities
- Webinar: Security and License Compliance Challenges in the Year Ahead
Follow Revenera
About Revenera
Revenera helps product executives build better products, accelerate time to value and monetize what matters. Revenera’s leading solutions help software and technology companies drive top line revenue with modern software monetization, understand usage and compliance with software usage analytics, empower the use of open source with software composition analysis and deliver an excellent user experience—for embedded, on-premises, cloud and SaaS products. To learn more, visit www.revenera.com.
