Name: Fundamentals of Open Source Risk Management
Start: 2024-09-25T16:00:00Z
End: 2024-09-25T16:01:12.000Z
Location: BrightTALK
Rating: 4.8

Black Duck is now defining the next frontier of application security. With the avalanche of AI-generated code plus expanding regulatory pressure, you need solutions that can scale, adapt, and keep pace with the demands of your business.

Black Duck meets the demands of modern software development with True Scale Application Security. In the cloud or on-prem, 100,000 lines of code or 100 million. For safety-critical systems with stringent compliance requirements or modern web apps deploying 100 times per day. Our flexible, scalable, high-precision solutions enable you to code with confidence.

Gain insights into important legal developments from two of the leading open source legal experts, Tony Decicco, Principal at GTC Law Group & Affiliates and Chris Stevenson, Of Counsel at DLA Piper.

This annual review will highlight the most significant legal developments related to open source software in 2025, focusing on topics that were resolved, those that got started, and what we can expect to see in coming years.

The 2025 Open Source Year in Review

AI coding assistants and open source AI models are revolutionizing productivity and innovation. But these new resources introduce a systemic challenge that impacts the entire pipeline. How do we embrace innovation without introducing invisible risk at astonishing scale? Does AI-enabled development threaten the value of the assets that drive your business? This session shows the results of a new study on this shared reality. It shows a way to get security and compliance done that doesn’t stop development teams.
We’ll address the main worries of technology executives and effective approaches to handling risks caused by AI. It's time to align development and security teams. You may ask how? Through integrated tools that make secure coding a natural part of daily workflows.
What’s in it for you?
• Gain exclusive insights from new research on AI adoption and its security implications
• Learn practical strategies to manage AI-generated risks in development pipelines
• Discover how to align Security and Development for frictionless, secure innovation

Secure or Sorry? What AppSec Leaders Must Know About AI Adoption

Open source software powers modern development—but it also introduces risks. From direct and transitive dependencies to container images, these risks can enter your applications in many ways, often without full visibility. 

Join this webinar to learn

• The common entry points for open source in your applications
• The risks of unmanaged open source, including vulnerabilities and license issues
• Best practices for securing and governing open source usage
• Tools and strategies for maintaining compliance and visibility

Whether you're a developer, security professional, or compliance lead, this session will help you build safer, more resilient software.

The Open Source Wildcard: Don't Roll the Dice on Risk

The tech M&A landscape is rapidly evolving with the pervasive integration of AI into target company applications. As machine learning, Generative AI, and other intelligent technologies become central to innovation, traditional software due diligence is no longer enough. This session addresses the critical new dimensions of risk and opportunity that AI introduces to acquisitions.

Join us for a practical framework designed to equip M&A principals and legal counsel with the tools to thoroughly assess AI-driven targets. We’ll dive into the essential areas you must explore, from evaluating model provenance and performance to navigating complex data governance and ethical considerations.

Key takeaways will include how-to effectively assess:

• AI Footprint: Understanding the strategic implementation and problem-solving capabilities of AI.
• Security Risks: Comprehensive data protection, access control, and penetration testing for AI systems.
• Legal & IP Risks: Clarifying model and training data ownership, alongside API terms.
• Quality & Reliability Risks: Ensuring performance, effective retraining, and model explainability.
• Regulatory & Compliance Risks: Navigating emerging regulations like the EU AI Act and critical data privacy concerns.

M&A's New Frontier: Assessing AI Software Risk in Your Next Deal

AI-enabled development tools and coding assistants are pushing CI pipelines, fueling innovation, and iterating business-critical software faster than ever before. Security teams are now forced to catch up. The burden to remedy AI tools often weak coding practices and to overcome their ignorance to third-party vulnerabilities and licenses is further complicated by developers' implicit trust in their output and an intrinsic incompatibility between AppSec and Dev teams' primary role: to ship functional code quickly.  

Enterprises can no longer treat development and AppSec workflows as separate entities. To unify them, however, requires fast, reliable, automated ways to evaluate every line of code that flows through the pipeline and to provide immediate access to fix methods. This only manifests with integrated security gates across CI/CD pipelines, aligned to risk-tolerance standards and optimized to maintain the speed benefits of AI-enabled development.  

Join us as we analyze DevSecOps in the age of AI and structure a viable strategy that accounts for:  

- Software security and license compliance issues introduced, at speed, by AI coding assistants  
- The dissonance between the adoption of AI-enabled dev tools and AppSec's preparedness to secure their output  
- Business priorities that span development, security, legal, and executive requirements

AI's IOU: Maximizing value from AI without paying for it later

With software development accelerating in the AI era, there are even more sources of vulnerabilities to track. Managing this is an enormously complex task, as organizations are already struggling to unify data across disparate tools for testing, SCM, and reporting. As more organizations adopt AI-assisted development, existing issues with fragmented risk visibility will only get bigger. 
 
In this webinar, you will learn about capabilities for achieving a high-fidelity, organizational view of risk posture to better streamline auditing, visualize AppSec gaps, and identify your most vulnerable software. We will talk about necessary capabilities for aggregating key sources of data, standardizing risk scoring, and how you can set up the right technical foundations for success.

Contextualizing Risk in the Age of AI Development

AppSec teams are being stretched to the limit trying to keep up with the pace, volume and complexity of modern application development. Current trends in software development – the transformative role AI, the increasingly complex and vulnerable software supply chain, and the mounting requirement to both scale and focus security issue remediation – help shed light on what measures organizations need to put in place to stay ahead.     

In this session we will outline these trends and provide data and insights from our research into them. We will also outline practical steps you can take now to position yourselves to manage the evolving requirements of Application Security.

The State of AppSec & Beyond

Join two of our cybersecurity experts for a lightning round that cuts through the hype and addresses the immediate challenges of AI in software development. We'll explore the paradigm shift that is reshaping creativity and problem-solving in development, the new frontier of AI-influenced software risk, and discuss ways in which AI coding assistants and open source AI models form the next evolution of the software supply chain crisis.
 
This session charts a course from high-level business concerns directly to the developer experience, examining:
- The business and contractual liabilities that arise when AI-generated code enters your products.
- New, instinct-driven "vibe programming" and the debate over whether this emerging methodology is a sustainable path to innovation or a source of unpredictable risk.
- How AI coding assistance alters hiring strategies and the critical role of code review by security-capable developers in an AI-driven workflow.
- Emerging attack vectors tied to the growing use of open-source AI models.
- Viable paths forward to harness the power of AI, manage its inherent risks, and minimize organizational disruption by establishing resilient and scalable safety nets within your pipeline.

AI-Assisted Disruption: How Change Impacts Dev and Sec as Organizations Pivot to AI

Application security hasn’t gotten any simpler—especially as AI accelerates the way software is built. More code, more complexity, and more fragmented tooling make it harder to answer a basic question: Where are we exposed?  

This session explores how teams can regain clarity at the first step of any risk management program. That means identifying what’s running, what’s been tested, and what needs attention. We’ll look at how automation, speed, and policy can work together to improve visibility without slowing delivery.  

As part of Black Duck’s broader approach to application risk management, we’ll also show how solutions like Black Duck Polaris™ Platform scales with the way modern teams build software.

Identifying Risk in the Age of AI-Assisted Development

Security is the result of implementing the tools, personnel, and insight necessary to make informed decisions to mitigate risks within the software you create and the assets you consume through the software supply chain. While this process can be elaborate, rapid releases and CI/CD methodologies require that AppSec move at the speed of DevOps.

Achieving this is only possible with integrated controls and mechanisms to detect, prioritize, and address security issues at every stage in the SDLC and CI/CD pipelines. But how do you get there?

Join us as we recommend ways to establish security within DevOps without sacrificing efficiency. We’ll discuss:
- Pitfalls that can derail an organization’s AppSec initiative
- Strategies for overcoming obstacles to efficient, effective DevSecOps
- Recommendations for realizing integrated DevSecOps at scale

Integrating AppSec for Efficient DevSecOps

AI technologies are compelling teams to accelerate software development and to explore innovations previously regarded as unattainable. While 67% of organizations use AI coding assistants at least weekly to realize these goals, 57% feel that using AI coding assistants has introduced new security risks or has made it harder to detect issues in their codebase. AppSec teams are scrambling to keep pace.  

Join us for an in-depth exploration of today's DevSecOps landscape based on our yearly Global State of DevSecOps report and findings from independent research institute, SANS. We'll examine the delicate balance between AI-assisted development and modern DevSecOps strategies, focusing on: 
* The impact of AI coding assistants on development pipelines and security workflows 
* How AI-ready organizations maximize AppSec coverage and agility 
* The evolution of traditional application security testing (AST) to AI-enabled AST 
* Prerequisites for a scalable, robust DevSecOps program purpose-built for AI-enabled development

From Code to Security: The DevSecOps Frontier

Securing your software supply chain begins with knowing what’s in your code. With AI-generated code and ubiquitous open source software use, it’s never been more critical to understand what risks your software may contain. In fact, last year alone we found that 81% of codebases contained a high-/critical risk vulnerability.
 
Join this webinar as we explore the findings from the 2025 “Open Source Security and Risk Analysis” report. We’ll cover:
 
• The state of open source software security
• Tips for mitigating risks and keeping vulnerabilities out of your supply chain
• How to protect against security and IP risks from AI coding tools

The 2025 Guide to Open Source Security and Risk

Evaluating a target’s software development process, software architecture, and code quality are becoming a must do in M&A software due diligence. Acquiring poorly designed software or buggy code could derail your post-close plans. 

Join this webinar to learn how to sidestep the tech debt trap. We’ll cover: 

      - The dimensions of software quality 
     - Norms for typical tech M&A targets 
     - How to uncover and mitigate tech debt and post-close “gotchas” 
     - Software due diligence best practices around software quality

Avoid Buggy Deals: Evaluating Software Quality in M&A Due Diligence

There are three regulations that every software development team should be aware of: NIST Secure Software Development Framework (SSDF), the EU Cyber Resilience Act (CRA), and the FDA Cybersecurity Requirements for Medical Devices. What’s your regulation IQ? 

Join this webinar to learn how to navigate these regulations to secure your software supply chain. We’ll cover:  

- Key requirements, commonalities, and differences across the three regulations  
- The importance of an SBOM in dependency tracking and risk management 
- Best practices for complying with these cybersecurity standards  

Register now.

How to Navigate NIST, CRA, and FDA Regulations

Software is essential in everyday products like cars, medical devices, airplanes, and IoT devices. Bugs and security flaws can have serious impacts on safety, the environment, and your reputation. As AI speeds up software development, it's more important than ever to keep your policies, coding standards, and testing up to date.

In this webinar, we’ll discuss:
- Trends that offer innovation but also increase the risk of costly errors
- Updates to functional safety standards that improve software reliability
- How to reduce supply chain risks by getting a full view of your software
- Strengthening software with thorough testing techniques

Register now to learn practical tips for creating secure, reliable functional safety software in 2025 and beyond.

Building Safe and Reliable Software in 2025

Developers have utilized source code management (SCM) tools since the 1980s to track, control, and manage changes across the software development life cycle. But the use of SCM tools is even more widespread now due to the emergence of distributed version control systems such as Git.

For DevSecOps though, it is essential to seamlessly integrate application security testing (AST) into the SCM environment, without compromising on fidelity and scalability. This gives organizations complete control over AST in their CI/CD pipelines.

What you'll learn:
- Onboard new projects easily from GitHub
- Get a centralized view of all your projects
- Orchestrate AST within GitHub actions & workflows
- Monitor all of your GitHub organizations continuously

Getting high fidelity AppSec results within your SCM environment

The Bridge CLI, Coverity CLI, and cov-build offer different ways to run your Coverity Static Analysis.  Join us as we explore how these tools complement each other and help you discover the right one for your CI/CD pipelines, pull request workflows, and ad-hoc scans. This session will include a live demonstration followed by a brief Q&A.  This webinar is targeted for developers, DevOps, or anyone responsible for configuring Coverity Analysis.

The CI/CD Plugin Playbook: How Bridge CLI, Coverity CLI, and cov-build Fit Together

Any tech acquisition target worth its salt is not only using generative AI tools to write code, but also incorporating AI technology into its products. As AI transforms these companies’ applications, and how they develop them, potential investors and acquirers face a new set of risks and questions. 

Join our panel of tech lawyer/AI experts for sage advice on how-to up your software due diligence game. Whether you’re an acquirer, an investor, or expect to be on the sell-side one of these days, learn about:

• The evolving state of risks associated with non-human written code
• Important considerations for integrators of AI models, evaluating the chain of custody and legal hygiene of datasets
• How due diligence is evolving to help investors and acquirers assess and plan for risks
• Market reps and warranties to complement derisking through due diligence 

Register today.

Intelligent Software Due Diligence in the Age of Artificial Intelligence

Generative artificial intelligence (GAI) will fundamentally change the way that software is built. Whether they are developing or using AI tools, organizations must understand the opportunities and risks involved, and evolve governance, policies and processes to address those risks.

Join this webinar for a deep dive into the issues that arise when using GAI in software development. We’ll cover:

• Open source data and software licenses and risks with AI
• Licensing and clearance considerations for materials used to train AI models
• Licensing considerations in building, training, and using AI models
• A deep dive on GitHub Copilot, including implications of the class action suit

Generative AI, Training Data, Open Source, and GitHub Copilot, Oh My!

Understanding the risks associated with open source software has become the norm in tech due diligence, but not all approaches are created equal. Knowing what’s in the software you’re acquiring is the first step. Few targets are able to produce an SBOM and when they do, it tends to be about 50% accurate. Is “good enough” good enough for M&A?

Join this live Synopsys webinar to learn how a purpose-built M&A open source audit differs from open source management tools and why it matters in tech due diligence. We’ll cover:

• The risks associated with open source software 
•Why depth of analysis matters, and what it results in during M&A diligence
•Why accuracy, reporting and expert human analysis are keys to thorough diligence

Don’t miss this informative webinar. Register today.

Open Source Software Audit vs Scan: What’s Right for M&A?

Tech M&A deals move fast, and there’s not always enough time, money, or bandwidth to complete diligence on all of the software assets that you’re acquiring. So how do you prioritize what you audit so that you can feel confident that you’re reducing risk in the right places?
 
Join this live webinar to hear how a legal software due diligence expert advises clients prioritizing their software due diligence. We’ll cover: 
 
• Where audits come up and why should you care about them
• Where an audit fits into the M&A transaction process
• How to “right size” an audit and strategically select code for auditing

How to Prioritize the Software You Diligence in Software Due Diligence

Open source is widely used in software development because it allows you to create high-quality software quickly - especially with the use of AI-assisted coding tools. But if left unmanaged, open source can lead to license compliance issues as well as security and code quality risks. Whether you’re on the buy side or sell side, these risks could negatively affect valuation in an M&A transaction.

Join this webinar for an inside look at the data Black Duck Audits complied in 2023 from the hundreds of tech transactions and thousands of codebases we audited. We’ll cover:

• Open source license and security risks by the numbers
• Why audits have become the norm in M&A tech due diligence
• How you can get a complete picture of open source risks

By the Numbers: 2024 Open Source Risk in M&A

Open source and third-party software make up the bulk of code in today’s applications. Open source has become so integral to modern development that security and development teams struggle to identify all the components in their software. AI code generation only adds to the difficulty.  

From license compliance issues to security vulnerabilities to reliance on stagnant projects, it’s never been more critical to know what’s in your code. It’s table stakes for addressing these risks.  

Join this live webinar to hear top open source legal experts discuss how to minimize risks while leveraging open source in software development and M&A. We’ll cover:  

- Roots of open source 
- Examination of the risks 
- Overview of the most popular open source licenses  
- Guidelines for managing

CLE:
DLA Piper LLP (US) has been certified by the State Bar of California, Illinois MCLE Board, the Board on Continuing Legal Education of the Supreme Court of New Jersey, and the New York State Continuing Legal Education Board as an Accredited Provider. The following CLE credit is being sought: 
• California: 1.25 Credit (1.25 General, 0.0 Ethics)
• Illinois: 1.25 Credit (1.25 General, 0.0 Professional Responsibility)
• New Jersey: 1.5 Credits (1.5 General, 0.0 Ethics)
• New York: 1.5 Transitional & Non-Transitional Credit (1.5 Professional Practice, 0.0 Ethics)
CLE credit will be applied for in other states where DLA Piper has an office with the exception of Minnesota, North Carolina, Pennsylvania, and Puerto Rico.

Fundamentals of Open Source Risk Management

Gain insights into important legal developments from two of the leading open source legal experts, Tony Decicco, Principal at GTC Law Group & Affiliates and Chris Stevenson, Of Counsel at DLA Piper.

This annual review will highlight the most significant legal developments related to open source software in 2023, focusing on topics that were resolved, those that got started and what we can expect to see in coming years.

We’ll cover:

• Updates on key open source-related litigation and disputes
• The Cyber Resilience Act and the Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence
• Potential liability for developers releasing and contributing to open source software
• The impacts of GAI coding tools, such as GitHub Copilot and Amazon CodeWhisperer
• Open source software controversies, deals, and hacks
• And much, much more

Register today!

CLE:
DLA Piper LLP (US) has been certified by the State Bar of California, Illinois MCLE Board, the Board on Continuing Legal Education of the Supreme Court of New Jersey, and the New York State Continuing Legal Education Board as an Accredited Provider. The following CLE credit is being sought: 
• California: 1.5 Credit (1.5 General, 0.0 Ethics)
• Illinois: 1.5 Credit (1.5 General, 0.0 Professional Responsibility)
• New Jersey: 1.8 Credits (1.8 General, 0.0 Ethics)
• New York: 1.5 Transitional & Non-Transitional Credit (1.5 Professional Practice, 0.0 Ethics)
CLE credit will be applied for in other states where DLA Piper has an office with the exception of Minnesota, North Carolina, and Puerto Rico.

The 2023 Open Source Year in Review

Open source is widely used in software development because it allows you to create high-quality software quickly - especially with the use of AI-assisted coding tools. But if left unmanaged, open source can lead to license compliance issues as well as security and code quality risks. Whether you’re on the buy side or sell side, these risks could negatively affect valuation in an M&A transaction.

Join this live webinar for an inside look at the data Black Duck Audits complied in 2023 from the hundreds of tech transactions and thousands of codebases we audited. We’ll cover:

• Open source license and security risks by the numbers
• Why audits have become the norm in M&A tech due diligence
• How you can get a complete picture of open source risks

Most software due diligence playbooks involve peer-to-peer discussions about products, processes, and people. That’s all extremely important as investors often bet on future development. But mitigating software risk in M&A requires not only evaluating the state of the target’s processes and organization, but also understanding the dimensions of technical debt that may lurk in the code.
 
Join this webinar to learn how your software due diligence process can uncover technical debt and reduce post-close headaches. We’ll cover best practices for evaluating: 
 
• The organization and processes 
• Quality of the architecture and code
• Application security risks
• Open source/third-party software

Software Due Diligence: Mitigating Multiple Dimensions of Risk

The evolution of newer technologies, like artificial intelligence, machine learning, GitHub Copilot, blockchain, cryptocurrencies, DeFi, APIs, containers, and SaaS/PaaS/IaaS, raise new open source legal issues and license selection and compliance considerations.

With these technologies becoming increasingly common place, do you have a strategy to manage your risk and compliance?
 
Join this live Synopsys webinar to learn how open source legal experts navigate the complex and ever- changing impact of new technologies. Topics covered include:
 
• A brief history of technological evolution in relation to open source software
• Legal and other considerations raised by these new technologies
• Practical strategies to mitigate related risks
 
Don’t miss this informative webinar - register today.

CLE:
DLA Piper LLP (US) has been certified by the State Bar of California, Illinois MCLE Board, the Board on Continuing Legal Education of the Supreme Court of New Jersey, and the New York State Continuing Legal Education Board as an Accredited Provider. The following CLE credit is being sought: 
• California: 1.0 Credit (1.0 General, 0.0 Ethics)
• Illinois: 1.0 Credit (1.0 General, 0.0 Ethics)
• New Jersey: 1.2 Credits (1.2 General, 0.0 Professional Responsibility)
• New York: 1.0 Transitional & Non-Transitional Credit (1.0 Professional Practice, 0.0 Ethics and Professionalism)
CLE credit will be applied in other states where DLA Piper has an office with the exception of Minnesota, North Carolina, and Puerto Rico.

Open Source Risks with New Technologies: AI, GitHub Copilot, Blockchain & More

Build trust into software due diligence

Open source and third-party software make up the bulk of code in today’s applications. Open source has become so integral to modern development that security and development teams struggle to identify all the components in their software. AI code generation only adds to the difficulty.  

From license compliance issues to security vulnerabilities to reliance on stagnant projects, it’s never been more critical to know what’s in your code. It’s table stakes for addressing these risks.  

Join this webinar to hear top open source legal experts discuss how to minimize risks while leveraging open source in software development and M&A. We’ll cover:  

- Roots of open source 
- Examination of the risks 
- Overview of the most popular open source licenses  
- Guidelines for managing

Open Source

Mergers

Mergers and Acquisitions

Software Development

Application Development

Application Security

software security

SDLC

CICD

Intellectual property law is crucial to ensuring that you or your organization have exclusive rights to that assets that you’ve created. The BrightTALK intellectual property community has thousands of professionals focused on learning and exchanging information about intellectual property management, intellectual property software and how to protect intellectual property. Join the community for access to free, interactive presentations or attend live webinars to have your questions answered by IP lawyers and industry experts.

Intellectual Property

The legal community on BrightTALK combines the fields of employment law, e-discovery, intellectual property and environmental law to create a thriving ecosystem of legal resources. Attend live and on-demand webinars dealing with employment contract law, e-discovery solutions, intellectual property software and sustainable development from leading lawyers and legal professionals to gain knowledge in a wide range of fields. Join the community and be part of the conversation by attending live legal webinars and connecting with industry thought leaders.

Legal

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

IT Security

Increasing expectations for good governance, effective risk management and complex demands for corporate compliance are presenting a growing challenge for organizations of all sizes. Join industry thought leaders as they provide you with practical advice on how to implement successful risk and compliance management strategies across your organization. Browse risk management resources in the form of interactive webinars and videos and ask questions of expert GRC professionals.

IT Governance, Risk and Compliance

The application development community features top thought leadership focusing on optimal practices in software development, SDLC methodology, mobile app development and application development platforms and tools. Join top software engineers and coders as they cover emerging trends in everything from enterprise app development to developing for mobile platforms such as Android and iOS.

Enterprise applications have become a crucial piece of infrastructure for many businesses. The enterprise applications community on BrightTALK features the latest insights in enterprise application integration, enterprise application architecture and EAS software. Join the community to gain access to thousands of videos and webinars presented by recognized enterprise information systems experts and arm yourself with the knowledge you need to succeed.

Enterprise Applications

Join thousands of engaged IT professionals in the application management community on BrightTALK. Interact with your peers in relevant webinars and videos on the latest trends and best practices for application lifecycle management, application performance management and application development.

Application Management

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Information Technology

Internal audit and compliance professionals are facing increasingly stringent regulatory requirements when it comes to compliance reporting and internal control procedures. Join the audit and compliance community to learn best practices from thought leaders on topics such as regulatory compliance, internal audit checklists and audit program strategies.

Audit and Compliance

Get powerful market trends insights that are shaping the M

The accounting and finance community on BrightTALK features presentations from leading accountants and finance professionals. The accounting community includes tax planning strategies, QuickBooks webinars and other accounting webinars, while the finance community features presentations on financial capital regulations and forensic data analytics. Join the conversation by attending live financial and accounting presentations and connecting with industry thought leaders.

Fundamentals of Open Source Risk Management

Presented by

About this talk

Black Duck