ESG Analyst Report on Checkmarx Supply Chain Security

To hunt these threats in open source software supply chains, new techniques must look at the health and wellness of open source projects, the reputation of contributors, anomalous activity such as sudden changes in package publishing routines, as well as performing static and dynamic analysis of package behavior. Performing, consolidating, and analyzing all of this (and more) information beyond the expertise of the vast majority of organizations. In conclusion, Application Security Tools, specifically Software Composition Analysis, must incorporate new techniques to meet modern security challenges in the use of open source software. Read the full ESG Showcase, “Comprehensive Open Source Supply Chain Security: Going Beyond SCA and SBOMs”