Sonatype 2017 State of the Software Supply Chain Report Reveals … – Business Wire (press release)

FULTON, Md.--(BUSINESS WIRE)--Sonatype, the leader in software supply chain automation, today announced the release of its third annual State of the Software Supply Chain Report. This years report highlights risks lurking within open source software components and quantifies the empirical benefits of actively managing software supply chain hygiene.

Organizations that are actively managing the quality of open source components flowing into production applications are realizing a 28 percent improvement in developer productivity, a 30 percent reduction in overall development costs, and a 48 percent increase in application quality. Furthermore, analysis of more than 17,000 applications reveals that applications built by teams utilizing automated governance tools reduced the percentage of defective components by 63%.

Conversely, organizations failing to manage software supply chains are unwittingly releasing vulnerable applications into production, wasting thousands of hours on rework and bug fixes, and facing increased liability due to gross negligence.

Additional key findings of the 2017 State of the Software Supply Chain report include:

Consumption of open source components is growing on a massive scale

Open source component suppliers remain slow to fix vulnerabilities

Number of downloaded components with known vulnerabilities is slightly decreasing

The regulatory landscape is rapidly changing

Supporting Quotes

Wayne Jackson, CEO, Sonatype Companies are no longer building software applications from scratch, they are manufacturing them as fast as they can using an infinite supply of open source component parts. However, many still rely on manual and time consuming governance and security practices instead of embracing DevOps-native automation. Our research continues to show that development teams managing trusted software supply chains are dramatically improving quality and productivity.

Mark Driver, Felix Gaehtgens, Mark ONeill, Gartner, May 2017 report Managing Digital Trust in the Software Development Life Cycle By 2020, 50% of organizations will have suffered damage caused by failing to manage trust in their, or their partners, software development life cycles (SDLC) causing revenue loss of more than 15%. Application leaders responsible for modernizing application development should re-evaluate the SDLC in the form of a trusted software supply chain, with varied levels of trust.

About the State of the Software Supply Chain Report

The 2017 State of the Software Supply Chain Report blends a broad set of public and proprietary data with expert research and analysis. This years report extends beyond Java data to include supply chain findings from JavaScript, NuGet, Python, and Docker ecosystems.

Additional Resources

About Sonatype

Sonatype is the leading provider of DevOps-native tools to automate modern software supply chains. As the creators of Apache Maven, the Central Repository, and Nexus Repository, Sonatype pioneered componentized software development and has a rich history of supporting open source innovation. Today, more than 120,000 organizations depend on Sonatypes Nexus platform to govern the volume, variety, and quality of open source components flowing into modern software applications. Sonatype is privately held with investments from New Enterprise Associates (NEA), Accel Partners, Hummer Winblad Venture Partners, Morgenthaler Ventures, Bay Partners and Goldman Sachs. Learn more at http://www.sonatype.com.

Here is the original post:
Sonatype 2017 State of the Software Supply Chain Report Reveals ... - Business Wire (press release)