Retour 
Today, open source software provides the foundation for the vast majority of applications across all industries, and software development has slowly moved toward software assembling. Because of this change in the way we deliver the software, new attack surfaces have evolved and software security is facing new challenges inherent with dependency on open source software. A few examples of open source vulnerabilities which had a severe impact are Log4j and the SolarWinds Supply Chain Attack, among many others.
As per the Synopsys Open Source Security and Risk Analysis” (OSSRA) 2021 report, 84% of open source codebases have had at least one vulnerability with an average of 158 vulnerabilities per codebase.
How the Netskope team addresses this
The Netskope Internal Security team utilizes Github Dependabot as one of the solutions to address the dependency problem. Dependabot keeps your dependencies up-to-date by informing you of any security vulnerabilities in your dependencies, and automatically opens pull requests to upgrade your dependencies to the next available secure version when a Dependabot alert is triggered, or to the latest version when a release is published.
Naturally, Dependabot aligns with the Netskope principle of embedding security in the developer workflow and being part of the developer experience by providing security-as-a-self-service.
