Since the most infamous breach at Equifax in 2017, adversaries routinely exploit open source vulnerabilities. Most recently (2020), the Department of Homeland Security published an alert that adversaries are continuously targeting these vulnerabilities, and the best defence is to vigorously maintain your ability to track and mitigate these emerging threats.

To protect your organization, here are the most important criteria to consider.

With the rising use of open source at enterprises, open source security solutions must effectively detect vulnerabilities. With adversaries taking advantage of vulnerabilities within days, you need a solution that goes beyond traditional vulnerability databases for completeness and speed. Many solutions that are good at detecting vulnerabilities have an undesirable side effect of high false positives. Having high false positives, in turn, waste your valuable developer resources time triaging false positives and creates vulnerability fatigue that puts your organization at risk.

Integration can be a significant effort with any new solution. It adds costs and time that takes away from your efforts to protect the enterprise. Some solutions give you a one-stop-shop approach but force your enterprise to adopt your vendor’s entire solution rather than your own. When did that ever work for you? Look for solutions that integrate well into your existing SDLC and your security ecosystem, and you will accelerate adoption and collaboration to your open source security program.

Open source security solutions have costs that go beyond the purchase of the solution. For example, false positives can add to your total cost of ownership (TCO). It creates additional work and often a lot of back and forth between different groups in the organization. Your valuable resources are directed to triage and resolve false positives. The people, technology, and process costs need to be factored into your total cost of ownership calculator to get a sense of the true cost of your open source solution.