In a world that runs on software, organizations face a big challenge: Writing good software. As software becomes increasingly complex, ensuring that it is reliable and secure becomes more difficult. Opportunities to make mistakes abound. This is true for purchased software, custom-developed internal and commercial software, and software delivered as a service. It is particularly true for open source software, which makes up more than 70% of the average commercial application. While open source benefits are clear-faster time to market, greater opportunities to innovate, lower development costs, and access to a global community of developers-the security and risk management challenges related to open source use are often overlooked.