Abandoned open source with Josh Marpet

The podcast discusses critical challenges in vendor risk management and open-source software security. Current practices, such as relying on repetitive and outdated questionnaires, are criticized for being inefficient and ineffective, especially in a rapidly evolving threat landscape. The discussion highlights how AI accelerates the discovery of vulnerabilities, making traditional, slow processes inadequate. A major focus is on the importance of monitoring code repositories for fixes rather than waiting for CVEs, which are often delayed and lack context. The research analyzed thousands of open-source packages across multiple ecosystems, revealing widespread issues with abandoned but still widely used software, misleading versioning, and insufficient definitions for maintenance status.

Further exploration centers on the evolving role of developers, who increasingly assemble software from third-party components, leading to complex dependency chains that expand the attack surface. Tools like SBOM (Software Bill of Materials) and VEX (Vulnerability Exploitability eXchange) are presented as essential for tracking and contextualizing risks. The conversation emphasizes the need for context-aware vulnerability prioritization - distinguishing critical, exploitable flaws from irrelevant ones - especially as compliance standards shift toward risk-based models. Additionally, the discussion touches on emerging efforts to assess maintainer trustworthiness through behavioral analytics and a proposed scoring system (Beacon Score), aiming to improve transparency and security in the software supply chain.

• What if you treated every open-source dependency as a potential breach vector?

  • Move: Audit your top 10 most-used third-party packages quarterly using SBOM tools (like Syft or Dependency-Track), flag any with no updates in 700+ days, and contact maintainers or fork if needed.
  • Why Now?: With AI enabling exploit generation in under 15 minutes post-patch, and abandoned packages sitting silently in production, the window for passive reliance on community maintenance is closing.
  • Expected Upside: Reduce risk of supply chain compromise by 60%+ in critical systems; avoid being caught in mass exploits targeting unmaintained but widely used libraries.

• What if you automated vulnerability triage using AI to filter signal from noise?

  • Move: Implement a script that ingests weekly CVE feeds, cross-references them with your SBOM, checks VEX data or reachability, and flags only the ~3 truly critical fixes using LLM-based context evaluation (e.g., "Is this path exploitable?").
  • Why Now?: Over 10,000 patches land weekly, but <0.1% matter to most systems. Manual triage is unsustainable; AI can now parse exploit context faster than human teams.
  • Expected Upside: Cut patch management time by 80%, free up dev hours, and shift focus from noise to actual threats - aligning with FedRAMP 20X-style compliance efficiency.

• What if you started treating your role as a problem validator instead of a code writer?

  • Move: For your next feature, define the problem in a spec document, generate the code via LLM, then spend 80% of your effort testing, securing, and stress-testing the output (for logic errors, injection risks, dependency health).
  • Why Now?: Developers are now "Legos assemblers" relying on ~17,000 libraries per product. The highest leverage act is no longer coding - it's validation, especially as AI-generated exploits rise in parallel with LLM-written code.
  • Expected Upside: Ship features 2 - 3x faster with higher security confidence, positioning your solo operation to scale output without adding team members.

• Monitor security fixes in open-source dependencies in real time by tracking version control repositories, not relying solely on delayed CVE disclosures.
• Implement a Software Bill of Materials (SBOM) for every product to maintain visibility into all third-party components and enable targeted vulnerability response.
• Use context-aware prioritization (e.g., reachability analysis) to filter the thousands of weekly vulnerabilities down to only those that actually impact your deployed systems.
• Adopt AI-assisted code review and testing workflows to quickly validate security and correctness of LLM-generated code as development increasingly shifts to AI collaboration.
• Evaluate and score third-party vendors and open-source maintainers based on activity, update frequency, and behavioral anomalies to proactively manage supply chain risk.