Customer trust
built on proof you can hand over.
Powered by
BAE SYSTEMS
U.S. AIR FORCE
U.S. NAVY
MARELLI
FAA
Built withIndustry Leaders.
Four pressureson every software team
Modern software is assembled from thousands of open-source packages, third-party components, containers, frameworks, and transitive dependencies. The risk is not just what your team writes. It is everything your product inherits.
98% of codebases run on open source
%of audited codebases contain open source
Proprietary code%
Open-source components%
Transitive dependencies%
Avg OSS components / app
YoY growth in OSS components+%
Average open source vulnerabilities per codebase, up 107%
Codebases with license conflicts%
Source: OSSRA 2026
Security teams are facing more findings than they can manually triage. The hard part is no longer only detection. It is deciding what matters, assigning ownership, proving remediation, and keeping evidence connected to the software lifecycle.
CVE volume is up 66% on last year
Actual 2026 through Jul 31 Forecast
Sources: NVD published CVE counts · FIRST 2026 forecast
AI-generated code is increasing delivery speed, but it also creates new questions around origin, review, reuse, and accountability. X-DLM helps teams connect software composition, policy checks, approvals, and lifecycle evidence before risk becomes a release blocker.
Provenance chain for AI-assisted code
01AI-generated code
02Open-source components
03Security finding
04Owner assigned
05Evidence captured
New devs using Copilot in week 1~80%
YoY repos using LLM SDKs+178%
Source: GitHub Octoverse 2025
CRA, DORA, PCI DSS, CMMC, FDA, and other software regulations are moving security from best practice into provable obligation. Teams need more than findings. They need traceability, governance, and evidence that shows what was found, who responded, and how the issue was resolved.
You are here
Sep 11, 2026
Vulnerability and incident reporting is live
Dec 11, 2027
Full CRA obligations apply
Ongoing
Audit evidence and lifecycle traceability
Source: European Commission · CRA Articles 13–14
98% of codebases run on open source
%of audited codebases contain open source
Proprietary code%
Open-source components%
Transitive dependencies%
Avg OSS components / app
YoY growth in OSS components+%
Average open source vulnerabilities per codebase, up 107%
Codebases with license conflicts%
Source: OSSRA 2026
Risk Impact
Risk by industryFrom OSSRA 2026, 947 audited codebases
581
Mean Vulnerabilities / Codebase
Highest in history92/ 100
Zombie or Out-of-Date Components
107%
YoY Increase in Vulnerabilities
98/ 100
Open Source or Third-Party Risk
81/ 100
High-Risk Codebases
68/ 100
License Conflicts
Highest in history~9,000
Uncatalogued Malware Packages
2,675
Max License Risks in a Codebase
OSSRA 2026
See the open-source risk behind these numbers.
Get the full Open Source Security and Risk Analysis 2026 report.
Turn security evidenceinto a sales advantage.
Regulation conformity
built on automated, real-time evidence.
Investor confidence
built on partnering with Siemens and Black Duck.
Regulatory readiness
The EU CRA gives you 24 hoursto report an exploited vulnerability.
EU CRA
LiveReporting live since Sep 11, 2026 · Full application Dec 11, 2027
Cyber Resilience Act
Products with digital elements sold in the EU.
FDA 524B
In forceIn force
FDA Section 524B
Cyber devices with software. Section 524B requires an SBOM.
IEC 62443
OngoingGlobal standard
Industrial Cybersecurity
Operational technology and industrial control systems.
NIS2
In forceIn force
Network & Information Security 2
Critical infrastructure and essential organizations.
DORA
In forceIn force
Digital Operational Resilience Act
Financial institutions and ICT providers.
CMMC 2.0
Under reviewUnder review
Cybersecurity Maturity Model Certification
Defense contractors and the software supply chain.
Upcoming events
New dates coming soon. Get the ProvableTrust Brief to hear first.
Resources
Executive Guides
Executive brochure
Lead in Cybersecurity with Siemens & Black Duck
For boards, CEOs, and CFOs. The market shift, in plain language.
Regulatory guide
Navigate the EU Cyber Resilience Act
Understand the evidence, timelines, and obligations required to demonstrate compliance.
Research report
OSSRA 2026: Open Source Security & Risk Analysis
Open-source, vulnerability, and license risk across thousands of audited codebases.
See your own evidence trail
in 30 minutes.
We help you understand where your cybersecurity story stands today, and where it can become a stronger source of trust, differentiation, and growth.
powered by
For growing companies
Smaller team?Start with a managed Black Duck scan.
Managed application security from Electro Source, built on Black Duck.
Begin a scan →No platform required
