The State of Software Supply Chain Security in 2024: Are You Ready for the Complexity?
May 13, 2024

Sean Pratt

Managing and securing your software supply chain is vital to delivering reliable, trusted releases in today's software world. With the constant growth of open-source components, assessing your organization's ability to manage them is crucial.

To help you prepare, JFrog compiled a report that combines the company's usage data, CVE analysis conducted by the JFrog Security Research Team, and commissioned third-party polling data from 1,224 professionals in security, development, and operations roles. Below is an overview of some key findings that we discovered.

Four of the report's most crucial themes include:

The software supply chain is growing rapidly: The open-source ecosystem is quickly expanding, leading to a vast software supply chain.

Understanding risk is key. Not all reported vulnerabilities require immediate attention, so focusing on where the real risks lie is essential.

Where security efforts should be focused: There's a growing awareness of security, but disjointed approaches cost development teams approximately a quarter of their monthly working time.

The impact of AI and ML: Organizations must be deliberate about leveraging AI-based tools and quickly adopt security best practices for model use.

The rapid expansion of tools, technologies, and programming languages in today's landscape presents a significant challenge for organizations and could place considerable pressure on their operations.

According to the report:

How many programming languages do you use in your software development organization? (Commissioned survey, 2023)

Over half of organizations (53%) utilize four to nine programming languages, while 31% use more than 10 languages. Predictably, the larger the organization, the more programming languages are likely used.

And while there are dozens of programming languages and packaging technologies to choose from when building production-ready applications, JFrog data shows that traditional, tried and true technologies are still the most popular — npm (Javascript), Maven (Java), Docker, PyPI (Python), Go, Nuget (.NET), and Conan (C/C++).

Number of new packages per year, displayed by package type (JFrog Catalog data, 2023)

For their chosen technologies, organizations have to sift through more and more open source packages to find the ones best suited for their projects. Docker and npm are the package types that have contributed the most by far. PyPI's contribution is also on the rise, likely driven by AI/ML use cases.

The variety of available open-source packages and libraries is thriving, but as the report explores, it inadvertently creates a world of potential risk for organizations. In 2023, over 26,000 new CVEs (Common Vulnerabilities and Exposures) were introduced to the open source ecosystem, continuing the upward trend YoY.

CVEs by month and severity in the last 2 years (National Vulnerability Database analyzed by JFrog Security Research)

An examination of CVEs recorded in the National Vulnerability Database from January 2022 to November 2023 reveals the consistent presence of Critical and Low CVEs, while medium and High CVEs show a notable upward trend. While this trend may raise concerns, an analysis of more than 200 high-profile CVEs in 2023 conducted by the JFrog Security Research team presents a contrasting narrative. The JFrog Security Research Team downgraded 85% of Critical CVEs and 73% of High CVEs it examined.

Vulnerabilities in Open Source components aren't the only source of risk organizations must manage. Human error also creates risk and has been the cause of some of the biggest security events of the past year. Take, for example, exposed secrets (ie. tokens) accidentally left in code. After examining common open-source software registries, including npm, PyPI, RubyGems, and DockerHub, the JFrog Security Research Team identified over 15,000 tokens. This is less than compared to 2022, but still an alarming number.

Organizations have a varied approach to tackling risk in their software supply chain — from where they scan and the different tools that they use. A third of respondents indicated their organization uses 10 or more application security tools, with nearly half using 4-9. The challenge is that security activities are taking up a significant amount of time — roughly 4 working days in a given month — that could be used to deliver new value to customers.

Looking forward, there will always be risk in software development and the growing complexity of the software supply chain will only make it more difficult to manage. However, with the right tools and practices, organizations can continue to drive software innovation and ensure that trusted, quality software is released to customers.

Sean Pratt is Senior DevSecOps Evangelist at JFrog
Share this

Industry News

May 16, 2024

Pegasystems announced the general availability of Pega Infinity ’24.1™.

May 16, 2024 and Sysdig unveiled a joint solution to help developers, DevOps, and security teams accelerate secure software delivery from development to deployment.

May 16, 2024

GitLab announced new innovations in GitLab 17 to streamline how organizations build, test, secure, and deploy software.

May 16, 2024

Kobiton announced the beta release of mobile test management, a new feature within its test automation platform.

May 15, 2024

Gearset announced its new CI/CD solution, Long Term Projects in Pipelines.

May 15, 2024

Rafay Systems has extended the capabilities of its enterprise PaaS for modern infrastructure to support graphics processing unit- (GPU-) based workloads.

May 15, 2024

NodeScript, a free, low-code developer environment for workflow automation and API integration, is released by UBIO.

May 14, 2024

IBM announced IBM Test Accelerator for Z, a solution designed to revolutionize testing on IBM Z, a tool that expedites the shift-left approach, fostering smooth collaboration between z/OS developers and testers.

May 14, 2024

StreamNative launched Ursa, a Kafka-compatible data streaming engine built on top of lakehouse storage.

May 14, 2024

GitKraken acquired code health innovator, CodeSee.

May 13, 2024

ServiceNow introduced a new no‑code development studio and new automation capabilities to accelerate and scale digital transformation across the enterprise.

May 13, 2024

Security Innovation has added new skills assessments to its Base Camp training platform for software security training.

May 13, 2024

CAST introduced CAST Highlight Extensions Marketplace — an integrated marketplace for the software intelligence product where users can effortlessly browse and download a diverse range of extensions and plugins.

May 09, 2024

Red Hat and Elastic announced an expanded collaboration to deliver next-generation search experiences supporting retrieval augmented generation (RAG) patterns using Elasticsearch as a preferred vector database solution integrated on Red Hat OpenShift AI.

May 09, 2024

Traceable AI announced an Early Access Program for its new Generative AI API Security capabilities.