The Open Source Question Coming Due in September

 

The Open Source Question Coming Due in September

EU CRA disclosure obligations start in about two months. Most finance and security leaders have not rehearsed the answer.

In roughly two months, the EU Cyber Resilience Act's first disclosure obligations take effect. Any organization with a product in scope will need to report actively exploited vulnerabilities within 24 hours, for products already on the market, not just new ones. Most finance and security leaders have not rehearsed what that report would actually say if they had to produce it today.

That is not a compliance detail. It is a rehearsal problem, and rehearsal problems are the ones that get discovered at the worst possible moment, in front of the worst possible audience.

Here is the exercise I would run before September, not after. Pick one dependency in your environment, any one, and try to answer three questions in writing: who decided this was acceptable to run, what would you show a regulator who asked you to document that decision, and what would it cost you if the answer turned out to be nobody and nothing.

Most executives who attempt this exercise get as far as "we have a scanner" and stop, because that is the only artifact anyone thought to produce. A scanner report is not a decision record. It documents what a particular tool found on a given day. It does not document who evaluated the risk of running that dependency in the first place, what alternative was considered and rejected, or why the answer was yes. A regulator asking for a defensible decision is not going to accept a tool's output as a substitute for a decision nobody made.

Socket recently tied a campaign called PolinRider, linked to North Korean state actors, to 162 malicious release artifacts across 108 packages and repositories spanning five different software ecosystems. I want to be precise about what that number represents. It is not one bad actor exploiting one bad dependency. It is a patient, well-resourced campaign working the intake layer of the software supply chain across five ecosystems at once. If a vendor showed up in 108 different places in your environment without anyone in procurement noticing, that would be a control failure worth a board briefing on its own. Open source gets a pass on that scrutiny for one reason: it never came with an invoice, so nobody in the organization was ever assigned to watch for it the way they would watch a vendor.

The AI acceleration piece is not theoretical. Researchers are describing an open weight model, GLM-5.2, as capable of advanced coding and cybersecurity work at a level close to models kept under much tighter control, and it can be downloaded and run locally, with no vendor standing between the model and whoever is using it. That means the volume of AI generated dependencies entering your environment, and the sophistication available to whoever wants to find a way in, are both accelerating at the same time, on a timeline that has nothing to do with your audit calendar.

It is worth noting what preparedness actually looks like right now, because it is not hypothetical. IBM and Red Hat recently expanded a service called Project Lightwell specifically to give regulated industries, starting with financial institutions, a way to share vulnerability data and coordinate patching confidentially, with SBOMs and compliance data attached to every package by default. That is not a product pitch. It is a signal of where the bar is moving. The organizations building toward that bar will have an answer ready in September. Most will not, and the gap between those two groups is not a technology gap. It is a documentation gap that started accumulating long before anyone thought to check.

In the current regulatory environment, a security failure is no longer only a company problem. The SEC's cybersecurity disclosure rules and the EU CRA both point the same direction: at some point soon, someone is going to ask an executive to produce the record of a decision, and "we had a scanner" is not going to be the record anyone is looking for. A scanner tells you what it found. It does not tell you who decided the underlying policy was acceptable, or when, or why.

This is not, in the end, a security team's homework assignment. The decision about what a company allows into its own software is a business decision with the same weight as any vendor contract the finance team already reviews, and it should be owned with the same rigor. Handing the entire question to security and expecting a scanner to stand in for governance is how organizations end up with a technical answer to a question a regulator is going to ask in business terms.

Most organizations can answer what their scanner found last quarter. Almost none can answer who decided, in writing, what their AI tools and their open source dependencies are allowed to bring into production, and whether that decision would survive being read aloud in front of a regulator. September is not far away. The organizations that treat the next ten weeks as a documentation exercise will have an answer. The ones that treat it as a technology problem will still be looking for a scanner report that was never going to be the right document in the first place.