State of the Source at ATO 2025: Cybersecurity – Open Source Initiative

Learn more about OSI’s mission, history, people, and programs.
Explore the list of OSI-Approved licenses and learn more about the license review process.
Learn more about Open Source AI, how do we define it, and its benefits to society.
Advancing Open Source through policy, regulation, and standards.
Supporting research, education, and knowledge about Open Source.
Connecting the people and organizations that build and support Open Source.
Explore the latest news, blog posts, newsletters, press mentions, and events from the OSI.
Learn more about OSI’s mission, history, people, and programs.
Explore the list of OSI-Approved licenses and learn more about the license review process.
Learn more about Open Source AI, how do we define it, and its benefits to society.
Advancing Open Source through policy, regulation, and standards.
Supporting research, education, and knowledge about Open Source.
Connecting the people and organizations that build and support Open Source.
Explore the latest news, blog posts, newsletters, press mentions, and events from the OSI.
In October, the OSI hosted the State of the Source Track at All Things Open designed to connect developers with the big policy conversations shaping our ecosystem. Katie Steen-James, Jeremy Stanley, Barry Peddycord III, and Bob Callaway led the panel Policy: Cybersecurity, with updates on SBOMs, the Cyber Resilience Act, and what developers need to know.
Panelists: Jeremy Stanley (OpenInfra Foundation), Barry Peddycord III (SAS), Bob Callaway (Google)Moderator: Katie Steen-James (Open Source Initiative)
Security of Open Source software is a constant topic of conversation with policymakers as they work to understand how Open Source fits into the supply chain and broader cybersecurity efforts. It’s important that practitioner voices are heard in these policy discussions. This session will provide practitioners and other interested parties with information about the current policy landscape as it relates to Open Source and cybersecurity. Participants will hear the latest updates focusing on the US and EU / UK and learn about opportunities for community participation and feedback in forthcoming cybersecurity policy discussions. Specific topics will include: Software Bill of Materials, Encryption, the EU’s Cyber Resilience Act, and more.
Katie Steen-James: Good afternoon, everyone, and thanks for joining us for our session on cybersecurity and policy. I’m Katie Steen-James, Senior U.S. Policy Manager at the Open Source Initiative. I’m joined by three experts in cybersecurity who bring a mix of industry, open source, and policy experience.
We’ll start with brief introductions, then I’ll ask a few questions to draw on their expertise and connect it to current policy developments. We’ll also leave time at the end for audience questions.
Bob Callaway: I’m Bob Callaway, and I lead Google’s Open Source Security Team. We’re a global team of about sixty people contributing to a variety of upstream ecosystems. Our goal is to improve overall software security while reducing the burden on maintainers.
I also serve on the governing board and technical advisory committee for the OpenSSF—the Open Source Security Foundation—where we partner with other foundations and communities to make open source security more sustainable.
Barry Peddycord III: I’m Barry Peddycord, and I work in the Open Source Program Office at SAS. My focus is on cybersecurity and compliance in our use of open source software. As we integrate open source components into our products, I help ensure we meet our security and legal responsibilities.
Jeremy Stanley: I’m Jeremy Stanley from the Open Infrastructure Foundation. I’m a long-time systems administrator and serve as a vulnerability manager for the OpenStack project. I’m also involved in the Eclipse Foundation’s Open Regulatory Compliance Working Group, which focuses on how regulations like the EU’s Cyber Resilience Act affect open source.
Katie Steen-James: Jeremy, can you tell us more about your work in the Open Regulatory Compliance Working Group and how it relates to the Cyber Resilience Act?
Jeremy Stanley: Sure. Early drafts of the CRA were concerning because they didn’t make distinctions between commercial software and community-driven open source. Fortunately, later drafts incorporated feedback from the open source community.
The Eclipse Foundation formed the Open Regulatory Compliance Working Group to provide structured input to the European Commission. The group includes both industry and nonprofit representatives and now focuses on helping standards bodies understand open source.
Currently, we’re working to ensure open source perspectives are represented as these “harmonized standards” are developed. Historically, standards organizations haven’t fully understood how open source operates, so that’s a big part of our challenge right now.
Katie Steen-James: Barry, you have deep experience with Software Bills of Materials—SBOMs. Can you explain what they are and how you use them at SAS?
Barry Peddycord III: Absolutely. A Software Bill of Materials, or SBOM, is essentially an inventory of all components—especially dependencies—used in a software product. It includes details like version numbers, origins, and licenses.
For SAS, which develops and sells technology products, SBOMs help us demonstrate to clients that we’re following security best practices and tracking our dependencies responsibly. They’ve also become a key part of procurement: customers increasingly expect them as part of due diligence.
SBOMs enhance transparency, making it easier to manage vulnerabilities and respond quickly when issues arise.
Katie Steen-James: Bob, can you tell us about your work with the OpenSSF and the Alpha-Omega project?
Bob Callaway: The OpenSSF brings together people passionate about improving open source security. We focus on several areas—education, tooling, and best practices. Education is foundational: helping developers understand basic