How BSIMM15 by Black Duck Highlights Security Strategies in AI and Software Supply Chains

Insights from Black Duck's BSIMM15 Report

The latest BSIMM15 report from Black Duck Software provides a comprehensive look at how organizations are addressing security risks associated with the integration of AI and software supply chains. Released on January 14, 2025, this report analyzes the software security practices of 121 diverse organizations across various sectors including cloud computing, fintech, and healthcare. The BSIMM (Building Security In Maturity Model) serves as a benchmark for software security initiatives, providing actionable insights for organizations looking to enhance their security posture.

Key Findings

The report highlights critical trends in the landscape of software security:

1. Adversarial Testing on the Rise: Organizations are increasingly recognizing the need for adversarial tests, with a remarkable 100% increase in the number of organizations implementing these tests year-over-year. As cyber threats evolve, such proactive measures are essential for identifying vulnerabilities before they can be exploited.

2. Software Composition Analysis Growth: There has been a 67% uptick in organizations performing Software Composition Analysis (SCA) on their code repositories. By understanding and managing the components that comprise their software, organizations can mitigate risks from third-party libraries and components.

3. Developing New Attack Methods: The report indicates a 30% growth in organizations collaborating with research groups to devise new attack methods. This proactive stance demonstrates a shift towards a more comprehensive understanding of potential threats.

4. Increased Focus on SBOMs: The creation of Software Bills of Materials (SBOMs) for deployed software has risen by 22%. This trend reflects the growing emphasis on compliance and transparency, particularly for organizations aiming to sell software to government entities.

The Balancing Act of Innovation and Security

In discussing the implications of these findings, Jason Schmitt, CEO of Black Duck, emphasized the dual nature of technological advancement. "While AI presents numerous opportunities, it also comes with its set of challenges," he stated. The report suggests that as AI continues to permeate various sectors, organizations must remain vigilant and prioritize security to build trust in their software.

The increasing complexity of the software supply chain necessitates a multi-faceted approach to safety. The BSIMM15 findings show that while many organizations are making strides in addressing these security challenges, there remain significant areas for improvement.

Training and Awareness

Despite these advancements in security practices, BSIMM15 noted a concerning trend in security awareness training. The percentage of organizations providing basic security training has decreased to 51.2%, a significant drop from the 100% recorded in the inaugural BSIMM1 report back in 2008. This decline may expose organizations to greater risk as employees may not be fully equipped to recognize or respond to security threats effectively.

The Road Ahead

The ongoing evolution of AI and software security mandates an adaptable approach to governance. Organizations that leverage the insights from BSIMM15 can navigate the complexities of modern software environments, ensuring that security remains a priority as they innovate. With the help of this comprehensive report, companies can assess their current practices, identify gaps, and take meaningful steps toward enhancing their security frameworks.

Black Duck’s commitment to providing valuable resources establishes it as a vital partner in the future of software security. Organizations interested in further insights can download the full BSIMM15 report, read associated blog posts, or participate in upcoming webinars designed to guide them through these evolving challenges.

For more information and to access the BSIMM15 report, visit Black Duck Software.