The oversight challenge in Open Source

Open-source software is the backbone of modern technology — but it’s also become a growing cybersecurity liability. As open-source adoption accelerates, so do vulnerabilities, blind spots, and the risk of malicious code slipping into production.

Open-source file usage has tripled since 2020. Today, 86% of commercial codebases contain vulnerabilities — many of them critical. Yet, according to TuxCare’s 2025 report, nearly half of security professionals don’t realize the threat is growing. Linux-specific vulnerabilities, for instance, have jumped 12x in just one year.

Michael Canavan, TuxCare CRO, puts it plainly: “Organizations must move beyond reactive thinking and implement continuous vulnerability scanning, threat intelligence integration, and transparent reporting. You can’t secure what you don’t accurately understand. The data show too many teams are still flying blind.”

Apiiro researchers found thousands of malicious code instances in open-source repositories. These threats use sophisticated obfuscation to evade detection — and traditional scanners often miss them. Worse, over 20% of dependencies aren’t even picked up by package managers, especially those introduced by AI tools.

Confidence in fully automated security has dropped sharply. Just 2.6% of teams now rely solely on automation — down from 14.5%. The trend is clear: human oversight is back. Teams need expert judgment for threat prioritization, patch validation, and incident response.

Major incidents like the XZ Utils backdoor and CrowdStrike platform failure (with losses up to $5.4B) have shattered trust in open-source supply chains. Black Duck’s OSSRA report shows 81% of codebases contain high- or critical-risk vulnerabilities, 90% use outdated components, only 77% of dependencies are visible via scanning tools.

To secure open-source ecosystems, organizations must use SBOMs and routine audits, combine automation with human expertise, enforce zero-trust policies for all code, invest in tools like Semgrep and Prevent for early detection.