Study reveals 58% of teams ship code faster than security review can keep up, as AI coding tools add dependencies that teams vet only about half the time

VANCOUVER, BC, Nov. 9, 2026 /PRNewswire/ — ActiveState, a sponsor and contributor to a new Linux Foundation research study supported by the Open Source Security Foundation (OpenSSF) and LF AI & Data Foundation, today announced findings from the State of AI Impact on Software Security and Cybersecurity 2026, revealing a growing gap between the pace of AI-driven software development and organizations’ ability to secure the code being produced. The study found that 58% of surveyed teams ship code faster than security reviews can keep up, while 60% say AI coding assistants have increased the number of external packages in their codebases. Yet teams review the indirect, or “transitive,” dependencies introduced by those packages only about half the time.

These challenges are becoming more urgent as AI accelerates both code generation and vulnerability discovery, leaving organizations less time to identify and remediate security flaws before attackers exploit them. The October 2026 PHP2Shell vulnerabilities underscored the urgency, with emergency patches issued and exploitation attempts reported within hours of disclosure. As vulnerabilities can be identified and exploited at increasing speed, organizations face mounting pressure to ensure security reviews, dependency vetting, and remediation keep pace.

The survey of 172 security practitioners across companies and open source projects also found that AI is part of the solution, albeit with some trade-offs. Respondents credited AI-assisted tools with detecting 30% of the vulnerabilities they found in the past year, and 69% said the tools had meaningfully improved their security posture. On average, AI tools made security work 17% faster, but false-positive vulnerability reports increased practitioners’ workloads by 30%, highlighting the need to balance AI-driven efficiency with effective security oversight.

“AI coding assistants don’t just write code. They choose your dependencies, and this research shows teams are checking only about half of what comes along for the ride,” said Abby Kearns, CEO of ActiveState. “That matches what we hear from customers every week. Slowing developers down won’t fix it. The answer is to decide what’s trusted before it reaches the codebase, so developers and their AI tools start from components security has already approved.”

Other key findings:

Skills are at risk. 82% of respondents agree that overreliance on AI tools weakens developers’ security skills.Concern outpaces readiness. For every AI-related threat measured, more practitioners are concerned than feel prepared. The widest gap, 41 points, is for AI-automated exploit generation and fuzzing.The supply chain tops the worry list. Supply chain attacks are the leading concern among security experts (93%), followed by prompt injection (90%) and the maintenance burden of high component-update volume (87%).Nobody owns it. Only 30% of teams have a dedicated role responsible for AI-related security threats, and only about one in three have a formal security policy that addresses AI.Ownership pays off. 75% of teams with a dedicated AI security role say they are well prepared for adversarial attacks on AI systems, compared with 50% of all respondents.Human review isn’t a given. Among teams with an AI security policy, only 57% require human review of AI-generated code.

Together, the findings point to a need to make security responsibilities explicit and strengthen governance as AI adoption grows. Dedicated roles, clear policies, and properly implemented tools correlate with greater preparedness; the survey does not establish that those practices cause the difference.

“As AI accelerates software development, organizations need to be just as deliberate about how they govern and secure the code being produced,” said Laura Guazzelli, Security Architect for AI/ML/LLM/Agentic Systems at OpenSSF. “That starts with understanding where AI is introducing risk into the software supply chain, establishing clear ownership for addressing it, and ensuring security practices can keep pace with how software is built.”

The report recommends that organizations assign a clear owner for AI-related security threats, formalize AI security policies that include human review of generated code, and strengthen controls on direct and transitive dependencies. Building on those findings, ActiveState recommends governing open source at the point of intake, alongside scanning and review, so security teams decide which components enter the software supply chain before developers or AI assistants pull them in.

Read State of AI Impact on Software Security and Cybersecurity 2026 for the findings and practical recommendations: https://www.linuxfoundation.org/research/ai-impact-on-cybersecurity-2026

About ActiveState

ActiveState secures the software supply chain at the source for the AI coding era. With the ActiveState Curated Catalog, a private, vetted repository of open source components, security teams decide what gets into enterprise software before developers or AI coding assistants pull it in. Security gets control, and engineering keeps its speed. The Curated Catalog works with the artifact repositories, scanners, and AI coding assistants that teams already use. Learn more at activestate.com.

View original content to download multimedia:https://www.prnewswire.com/news-releases/ai-is-writing-code-faster-than-security-can-review-it-finds-new-linux-foundation-research-sponsored-by-activestate-302931650.html

SOURCE ActiveState

Broadened AI security guidance, relationships, and research to help close the gap between AI-driven development and software security

SALT LAKE CITY, Nov. 9, 2026 /PRNewswire/ — The Open Source Security Foundation (OpenSSF), a cross-industry initiative of the Linux Foundation focused on sustainably securing open source software, today announced new membership growth, welcoming Beautiful Majestic Dolphin, DevGuard, and UElement Technologies to the foundation. The OpenSSF also notes new and expanded efforts to help organizations secure software in the age of AI, including membership with the Multi-Organization Secure AI Coordination (MOSAIC) for better AI security, a new guide to finding and fixing vulnerabilities using AI, and new research on AI’s impact on software security.

AI is redefining the Software Development Life Cycle (SDLC). It impacts both the rate at which code is produced and how quickly vulnerabilities are discovered and reported – for attackers and defenders alike. With bugs easier to find and reporting windows shrinking under regulations like the EU Cyber Resilience Act (CRA), organizations need clear, practical guidance on using AI to secure software. OpenSSF continues to serve as a trusted, neutral hub for AI security education, collaboration, and open source software security.

“Security must keep pace with this new software development lifecycle,” said Laura Guazzelli, Security Architect for AI/ML/LLM/Agentic Systems at OpenSSF. “This new SDLC has collapsed the window between bug discovery and automated attack, exposing defenses that are unprepared for AI-driven threats and offensive campaigns. This is why we are focused on equipping developers with practical resources, from guidance on finding and fixing vulnerabilities with AI to new data on how AI is shaping software development.”

New OpenSSF members include Beautiful Majestic Dolphin, DevGuard, and UElement Technologies who join the Foundation as General Members. These organizations join a community of working groups, technical groups, and experts that are shaping the future of OpenSSF and software security. Their membership reinforces the long term sustainability of open source and the projects that are critical to modern infrastructure.

Q4 Foundation Achievements
In the fourth quarter of 2026, OpenSSF achieved the following milestones:

OpenSSF joins MOSAIC – Membership with MOSAIC allows OpenSSF and MOSAIC members to pool knowledge and resources for consistent standards and guidance on AI security. A major goal of the group is a standardized map of the participating initiatives, which includes aligning with other initiatives such as NIST SP 800-53 Control SC-42, building on existing frameworks, a general consensus on MOSAIC definitions, and more.State of AI Impact on Software Security and Cybersecurity 2026 report – The study, supported by OpenSSF, ActiveState and LF AI & Data Foundation, found a growing gap between the pace of AI-driven software development and organizations’ ability to secure the code being produced: 58% of surveyed teams ship code faster than security reviews can keep up, while 60% say AI coding assistants have increased the number of external packages in their codebases. This data underscores the importance of trusted, reliable guidance as AI deployment continues to grow.Secure AI Associate (SAIA) certification – OpenSSF and Linux Foundation Education are launching the Secure AI Associate (SAIA) certification. This new credential will provide learners with skills to find and fix security risks across the full AI/ML lifecycle, from training data to production pipelines. The certification launches in December 2026 and interested parties can sign up for exam availability notifications here.New guide to finding and fixing vulnerabilities using AI – The OpenSSF Best Practices and AI/ML working groups released Finding and Fixing Software Vulnerabilities Using AI: A Guide for Developers, a free guide for developers and security researchers on using AI to find and fix vulnerabilities before attackers can exploit them. Built on principles that outlast any single tool, it covers the full process, from preparing and sandboxing AI to validating, fixing, and preventing issues, and stresses that AI-generated patches should never be trusted without automated tests and human review. An online course (LFD126) is planned for the coming months.Case study: GitHub expands malware advisories across eight ecosystems – A new case study shows how GitHub integrated OpenSSF’s Malicious Packages data into its Advisory Database, expanding Dependabot malware alerts beyond npm to eight package ecosystems, including PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer. The community-driven repository now holds more than 238,000 malicious package reports, showing how shared, open data can help defenders keep pace with fast-moving supply chain attacks.Zarf 1.0 marks a major milestone for the OpenSSF – the release helps teams package and deploy software in environments disconnected from the internet. Version 1.0 strengthens package signing and verification workflows, improves configuration management, and establishes a foundation for long-term compatibility and community-driven development.

Supporting Quotes

“Scanning tells you what went wrong. Knowing where your software came from tells you whether it should have been trusted at all. ActiveState builds open source from verified source so that secure is the default, and joining the OpenSSF is a natural next step in making that true for everyone who builds on open source.”
– Abby Kearns, CEO, ActiveState

“We think that you should be able to determine why things happen. Who, what, when, where, and how? Those questions can all easily be understood, but why is one of the hardest parts of cybersecurity. That’s why we made GoRapide open source, under an MIT license. We know why we build for our customers, but ultimately we can’t know every reason why someone might ask, ‘Why?’ For us, joining the Open Source Security Foundation made sense because open source is integral to our company mission.”
– Shane Morris, CEO, Beautiful Majestic Dolphin

“We built open-source DevGuard to make secure software development the default, not the exception. We already use OpenSSF projects and data to help our users secure their entire software development lifecycle, so joining the OpenSSF feels like a natural step. We’re proud to become part of the community shaping the future of open-source security and look forward to giving back.”
– Tim Bastin, CTO, DevGuard – L3montree GmbH

“Open source is the common ground the world’s digital economy is built on and India is now one of its largest builders. Keeping that ground secure isn’t one company’s or one country’s job; it belongs to all of us. UElement joins OpenSSF to help make it trustworthy today and quantum-safe tomorrow, so the systems people depend on, from banks to public infrastructure, can be built in the open and trusted everywhere.”
– Chaitanya Vijay Ghate, Co-founder & CEO, UElement Technologies

Events and Gatherings
OpenSSF members are gathering this week in Salt Lake City at Open Source SecurityCon North America and onsite at KubeCon + CloudNativeCon North America (November 9-12). Those interested in joining OpenSSF at events in 2027 should mark their calendars for Open Source SecurityCon Europe, which is planned for March 15, 2027.

Additional Resources

View the complete list of OpenSSF membersContribute efforts to one or more of the active OpenSSF working groups and projectsSign up for the OpenSSF newsletter to receive updates on upcoming events, resources, and community news.

About the OpenSSF
The Open Source Security Foundation (OpenSSF) is a cross-industry organization at the Linux Foundation that brings together the industry’s most important open source security initiatives and the individuals and companies that support them. The OpenSSF is committed to collaboration and working both upstream and with existing communities to advance open source security for all. For more information, please visit us at openssf.org.

About the Linux Foundation 
The Linux Foundation is the world’s leading home for collaboration on open source software, hardware, standards, and data. Linux Foundation projects, including Linux, Kubernetes, Model Context Protocol (MCP), OpenChain, OpenSearch, OpenSSF, OpenStack, PyTorch, Ray, RISC-V, SPDX and Zephyr, provide the foundation for global infrastructure. The Linux Foundation is focused on leveraging best practices and addressing the needs of contributors, users, and solution providers to create sustainable models for open collaboration. For more information, please visit us at linuxfoundation.org.

The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see its trademark usage page: www.linuxfoundation.org/trademark-usage. Linux is a registered trademark of Linus Torvalds.

Media Contact
Grace Lucier
The Linux Foundation
pr@linuxfoundation.org 

View original content to download multimedia:https://www.prnewswire.com/news-releases/openssf-welcomes-new-members-and-expands-ai-security-resources-302932951.html

SOURCE OpenSSF

Seasoned broadband executive Kerry Conn joins Fatbeam to strengthen operations, scale business performance, and support the company’s next phase of growth.

COEUR D’ALENE, Idaho, Nov. 9, 2026 /PRNewswire/ — Fatbeam Fiber, a leading provider of fiber optic broadband in the western United States, is thrilled to announce the addition of Kerry Conn as Chief Operating Officer (COO). Bringing 25 years of leadership experience across broadband, operations, technology, and finance, Kerry will help guide Fatbeam’s operational strategy and support the company’s continued growth and commitment to delivering reliable connectivity to the communities it serves.

Kerry brings a strong track record of scaling broadband organizations, optimizing operational execution, and bridging the gap between technology and financial strategy to drive sustainable growth. Most recently, she served at Rise Internet, an internet service provider serving residential customers across 16 states, where she led Operations, IT, and Strategic Initiatives.

Prior to Rise Internet, Kerry served as both Chief Financial and Operating Officer at AtLink Services, an Oklahoma-based fixed wireless provider. During her 15-year tenure, she helped grow the company from approximately 400 subscribers to 20,000, contributing to its significant expansion and operational development.

“At Fatbeam, everything comes back to the customer experience, and Kerry shares that commitment. Kerry has a proven track record of building high-performing teams, and I’m confident she will help us keep raising the bar for service and reliability across every market we serve.” – Paul Merritt, CEO, Fatbeam Fiber

Passionate about solving complex challenges, building high-performing teams, and creating the processes and systems that enable people to excel, Kerry brings deep expertise in field operations, network reliability, technology infrastructure, and financial planning. Her broad experience provides a well-rounded perspective on the operational and strategic priorities critical to scaling and sustaining a successful broadband business.

“I’m excited to join Fatbeam Fiber and get to know the team. I look forward to working together to strengthen our operations, empower our people, and support the company’s continued growth and success.” — Kerry Conn, COO, Fatbeam Fiber

For more information, please visit www.fatbeam.com.

About Fatbeam Fiber

Fatbeam provides reliable fiber-based network solutions to enterprise, healthcare, government, education, and residential customers in the Western United States. They believe in giving residential customers peace of mind and enabling businesses to concentrate on operations by providing a superior product at the right price to meet needs now and in the future.

Media Contact:

Keeley Fenley
Marketing Manager
marketing@fatbeam.com
(509) 344-1008

View original content to download multimedia:https://www.prnewswire.com/news-releases/fatbeam-fiber-welcomes-kerry-conn-as-chief-operating-officer-302931406.html

SOURCE Fatbeam