One of the most neglected parts of application security is the ingredients that go into developing software. Over 80 percent of code used in enterprise applications comes from open source dependencies, but how much attention goes towards the provenance and security of those packages. And in the pursuit of accelerated software development, developers are leveraging more and more libraries and also code “created” by generative AI algorithms, so how do you prevent defects or malicious payloads from compromising your security?

This is analogous to a restaurant where you invest in modern decor, professional chefs, and world class service. But if you don’t get fresh, quality ingredients delivered daily, the taste and hygiene of the food will suffer. Securing the software supply chain is a huge undertaking for the entire tech industry, and we will talk about some of the ongoing efforts by open source projects, foundations, and corporations to help us all know our ingredients.