FossID

Empowering people. One line of code at a time. We encourage people to use open-source confidently & safely.

[FossID @FOSSID_AB]

⚽It’s almost here! The World Cup should be dramatic.

EU CRA compliance shouldn't be.

If you're preparing for CRA requirements, understanding what's inside your software starts with an SBOM.

Read more: https://t.co/CS3HfTZ8vW

#EUCRA #SBOM #AppSec

[FossID @FOSSID_AB]

In this article, FossID reveals 5 common (and costly) surprises uncovered during audits.
👉 https://t.co/g5Y37Q2qjg

[FossID @FOSSID_AB]

💥 5 Open Source Compliance Surprises That Could Be Hiding in Your Codebase

Even with SBOMs & compliance processes in place, expert audits keep turning up issues no one saw coming. The reality? What you don’t know about your open-source usage can hurt you https://t.co/g5Y37Q2qjg

[FossID @FOSSID_AB]

Compliance isn’t a cost—it’s a growth enabler.
👉 https://t.co/jq53SYWrYp

#AI #AppSec #SoftwareCompliance #SBOM

[FossID @FOSSID_AB]

AI-generated code is everywhere.
But without compliance, it brings:
⚠️ Legal/IP risk
⚠️ Slower audits
⚠️ Lost M&A opportunities

The ROI of proactive compliance?
✅ Reduced risk
✅ Faster audits
✅ Protected IP value

[FossID @FOSSID_AB]

Our SBOM Lifecycle Management Checklist shows how to make them scalable and audit-ready.

👉️ https://t.co/91lzL45Naa
#SBOM #DevSecOps #SoftwareSupplyChain #SoftwareSecurity

[FossID @FOSSID_AB]

Most teams don’t struggle to generate SBOMs anymore. They struggle to manage them.

Different formats. Inconsistent quality. Manual validation.
The result? SBOMs exist, but they aren’t operational.

[FossID @FOSSID_AB]

In this article, Aaron Branson shows how that shift is breaking traditional approaches to SCA... and why compliance must move from a downstream activity to something that happens as code is created.

👉 https://t.co/nkMXhRkU1C (2/2)

#DevOps #DevSecOps #SCA #AgenticSCA

[FossID @FOSSID_AB]

The pressure on software teams isn’t coming from one direction anymore.

Development is accelerating. AI is increasing the volume and speed of code creation.

At the same time, nothing about compliance expectations has changed.

What’s changed is everything in between. (1/2)

[FossID @FOSSID_AB]

If your teams are using AI to write code, this is a must-read.

Full article: https://t.co/vZZal2HTwn (2/2)

@LF_Europe @linuxfoundation @todogroup

[FossID @FOSSID_AB]

AI-assisted coding is here, but accountability isn’t going anywhere.

In this guest post, Dr. Ibrahim Haddad breaks down what the Linux kernel’s new AI guidance really means for enterprises – and why it sets the tone for the future of software license compliance. (1/2)

[FossID @FOSSID_AB]

Workbench 26.1 delivers exactly that.

Read on for all the highlights and a preview of what's to come in 26.2!
https://t.co/HQ7lpDaiSO (3/3)

#SoftwareSupplyChain #OpenSourceSoftware #AppSec #DevSecOps

[FossID @FOSSID_AB]

FossID Workbench 26.1 is here! Why are we so excited about this release?

This marks a significant step forward in making continuous compliance practical for every team. (1/3)

[FossID @FOSSID_AB]

As organizations scale their software development and integrate more complex supply chains, they need an SCA workflow that supports them beyond the initial scan, one that makes it easier to understand existing risks and manage new ones as they emerge. (2/3)

[FossID @FOSSID_AB]

If you’re moving beyond SBOM generation, this new report is a must-read. https://t.co/886QolfGKQ

#SBOM

[FossID @FOSSID_AB]

Go from “Do we have an SBOM?” → to → “Can we trust it, maintain it, and act on it continuously?”

Ibrahim Haddad shares a practical blueprint for operationalizing SBOMs across the full lifecycle, turning them from static artifacts into something teams can actually work with.

[FossID @FOSSID_AB]

Join the early access list at https://t.co/3LWnX8Jrmr (3/3)

#Agentic #SCA #SBOM #SoftwareLifecycle #SoftwareSupplyChain #DevSecOps

[FossID @FOSSID_AB]

What's In Your Software?

Agentic SCA by #FossID ensures you have complete visibility throughout the software lifecycle. (1/3)

[FossID @FOSSID_AB]

1️⃣ Code Creation: Embed continuous compliance into code creation with your AI agent.

2️⃣ Code Integration:
Detect and enforce policy issues before code merges in your SCM.

3️⃣ Code Delivery:
Validate your full project and generate an SBOM before release.

(2/3)

[FossID @FOSSID_AB]

No SBOM maturity = no CRA readiness.

More here: https://t.co/TjbbjqnzZP

#SBOM #EUCRA #Compliance

[FossID @FOSSID_AB]

EU CRA compliance doesn’t start in 2027. It starts with your SBOM process now.

The 2026 requirement to report actively exploited vulnerabilities within tight timelines is only realistic if you have accurate, automated, versioned SBOMs in place.