Exemplars, Laggards, & The Cautious: A Data-driven Look At High-velocity Software...
summary
Year‑long empirical analysis of 12,000 commercial teams and 36,000 open‑source projects shows concrete gains: 50% more commits, 2.4X faster releases, and 2.9X faster vulnerability remediation for exemplar teams. The dataset also finds 85% of application code is open source, median time to update a vulnerable component is 180 days (mean ~1 year), and projects using CI/automation and GitHub alerts schedule updates and remediate far faster, while unmanaged supply chains show ~24% of components with known vulnerabilities.
AI-written summary · about
chapters (8)
- 0:00Start
- 2:18State of the Software Supply Chain Report
- 2:38Three Ways of Devops
- 3:07Phoenix Project
- 9:35How Do You Pick the Best Open Source Projects To Work with
- 11:38Comparing Release Frequency and Popularity of Open Source Projects
- 15:17The Time To Remediate Hypothesis
- 25:58Laggards
related talks
32mExemplars, Laggards, and Hoarders: A Data-driven Look at Open Source Software Supply Chains
31m54,000 Tales - A Data-driven Discussion of Exemplar Development and DevSecOps Practices
45mDon’t be Afraid to Upgrade- 45mDon’t be Afraid to Upgrade
43mHuman factors that influence secure software development
47m11,000 Voices: Experts Shed Light on 4-Year Open Source & AppSec Survey
30mDevSecOps: Understanding Open Source Software risk in your applications
35mMachines Making Software