As part of the Open Source Security Foundation (OpenSSF), many companies have adopted our tools and technology to improve their cybersecurity efforts. We invite you to join our community and contribute to the ongoing efforts in strengthening open source software security.
Tools: GUAC, OSPS Baseline, LFX Insights Challenge: Demonstrating strong security posture quickly and credibly to stakeholders Solution: Leveraging Linux Foundation Insights (LFX Insights) and the Open Source Security Foundation (OpenSSF) Open Source Project Security Baseline (OSPS Baseline) for instant, standards-aligned validation Result: Saved significant time in verifying security practices, completing… Read more.
As machine learning (ML) evolves at lightning speed, so do the threats. The rise of large models like LLMs has accelerated innovation—but also introduced serious vulnerabilities. Data poisoning, model tampering, and unverifiable origins are not theoretical—they’re real risks that impact the entire ML supply chain. Read more.
Organization: Open Source Technology Improvement Fund, Inc. (OSTIF) Contributor: Amir Montazery, Managing Director Website: ostif.org Problem Critical open source software (OSS) projects—especially those that are long-standing and widely adopted—often lack the resources and systematic support needed to regularly review and improve their security posture. Many of these projects are maintained… Read more.
Ericsson, a global leader in telecommunications and networking, has been deeply engaged in open source and software security for over a decade. Through its Open Source Program Office (OSPO), Ericsson coordinates its participation across multiple foundations and initiatives, including the Open Source Security Foundation (OpenSSF). This case study highlights Ericsson's… Read more.
Challenge For many years, the software supply chain has suffered from a lack of transparency and inefficient, unsustainable security management methods such as spreadsheets, emails, and word of mouth. The severity of these challenges was highlighted during incidents like Log4Shell, where the limitations of these approaches became evident — organizations… Read more.
Stacklok was founded in 2023 by Craig McLuckie (co-creator of Kubernetes) and Luke Hinds (creator of the OpenSSF project Sigstore), with the goal of helping developers produce and consume open source software more safely. Read more.
There’s an increasing need across enterprises and the open source ecosystem to have a verifiable way to link software artifacts back to their source code and build instructions. And with more than 100 million developers building on GitHub, we want to ensure that developers have the tools needed to help… Read more.
Scorecard is an automated tool from the OpenSSF that assesses 19 different vectors with heuristics ("checks") associated with important software security aspects and assigns each check a score of 0-10. You can use these scores to understand specific areas to improve in order to strengthen the security posture of your… Read more.
In this post, we will explore how Yahoo leverages Sigstore, in concert with Athenz, an open source platform for managing X.509 certificates, as an internal Certificate Authority, to sign and verify container images. Read more.
Microsoft worked with partners to establish the OpenSSF to ensure the open source communities we collectively build, support, and depend upon have the best tools, infrastructure, and experience to be as secure as possible. We are proud to continue investing in that mission’s success.
Mark RussinovichAzure CTO and Technical Fellow at Microsoft
“
As a longstanding member of the open source community, Intel strongly supports organizations like OpenSSF that inspire and enable the creation of more innovative solutions that secure the open source software we all depend on. Our contributions, along with other members of the open source ecosystem, help OpenSSF continue to break down barriers of security for all.
Arun GuptaVice President and General Manager for Open Ecosystem at Intel Corporation and OpenSSF Governing Board Chair
“
NYU Tandon is working with OpenSSF to improve open source security. OpenSSF's mission of securing the software supply chain is one of the key security issues of our time. We are proud to help the OpenSSF shape a more secure future, while training the next generation of cybersecurity professionals.
Justin CapposAssociate Professor, Tandon Computer Science and Engineering Department at New York University
“
Open source software security is a top priority for AWS. That’s why we are deeply invested in multiple initiatives, including OpenSSF, to provide open source communities with the financial support, expertise, and resources they need to enhance the security of the software that we all rely on.
Mark RylandDirector, Amazon Security at Amazon Web Services (AWS)
“
The OpenSSF plays a vital role in strengthening the security posture of open source software by bringing together open source developers and the industry to jointly create tools and methods for secure open source software development. Ericsson is a proud and committed supporter of the OpenSSF’s mission.
Per BemingHead of Standard and Industry Initiatives, Ericsson
“
OpenSSF’s support, collaboration, and resources enable us to move forward confidently, ensuring that our innovations not only push boundaries but also uphold strong security standards. As a contributing OpenSSF member, we reinforce Intel’s dedication to advancing open source software security and creating trusted open solutions for the future.