Broadened AI security guidance, relationships, and research to help close the gap between AI-driven development and software security

SALT LAKE CITY, Nov. 9, 2026 /PRNewswire/ — The Open Source Security Foundation (OpenSSF), a cross-industry initiative of the Linux Foundation focused on sustainably securing open source software, today announced new membership growth, welcoming Beautiful Majestic Dolphin, DevGuard, and UElement Technologies to the foundation. The OpenSSF also notes new and expanded efforts to help organizations secure software in the age of AI, including membership with the Multi-Organization Secure AI Coordination (MOSAIC) for better AI security, a new guide to finding and fixing vulnerabilities using AI, and new research on AI’s impact on software security.

AI is redefining the Software Development Life Cycle (SDLC). It impacts both the rate at which code is produced and how quickly vulnerabilities are discovered and reported – for attackers and defenders alike. With bugs easier to find and reporting windows shrinking under regulations like the EU Cyber Resilience Act (CRA), organizations need clear, practical guidance on using AI to secure software. OpenSSF continues to serve as a trusted, neutral hub for AI security education, collaboration, and open source software security.

“Security must keep pace with this new software development lifecycle,” said Laura Guazzelli, Security Architect for AI/ML/LLM/Agentic Systems at OpenSSF. “This new SDLC has collapsed the window between bug discovery and automated attack, exposing defenses that are unprepared for AI-driven threats and offensive campaigns. This is why we are focused on equipping developers with practical resources, from guidance on finding and fixing vulnerabilities with AI to new data on how AI is shaping software development.”

New OpenSSF members include Beautiful Majestic Dolphin, DevGuard, and UElement Technologies who join the Foundation as General Members. These organizations join a community of working groups, technical groups, and experts that are shaping the future of OpenSSF and software security. Their membership reinforces the long term sustainability of open source and the projects that are critical to modern infrastructure.

Q4 Foundation Achievements
In the fourth quarter of 2026, OpenSSF achieved the following milestones:

• OpenSSF joins MOSAIC – Membership with MOSAIC allows OpenSSF and MOSAIC members to pool knowledge and resources for consistent standards and guidance on AI security. A major goal of the group is a standardized map of the participating initiatives, which includes aligning with other initiatives such as NIST SP 800-53 Control SC-42, building on existing frameworks, a general consensus on MOSAIC definitions, and more.
• State of AI Impact on Software Security and Cybersecurity 2026 report – The study, supported by OpenSSF, ActiveState and LF AI & Data Foundation, found a growing gap between the pace of AI-driven software development and organizations’ ability to secure the code being produced: 58% of surveyed teams ship code faster than security reviews can keep up, while 60% say AI coding assistants have increased the number of external packages in their codebases. This data underscores the importance of trusted, reliable guidance as AI deployment continues to grow.
• Secure AI Associate (SAIA) certification – OpenSSF and Linux Foundation Education are launching the Secure AI Associate (SAIA) certification. This new credential will provide learners with skills to find and fix security risks across the full AI/ML lifecycle, from training data to production pipelines. The certification launches in December 2026 and interested parties can sign up for exam availability notifications here.
• New guide to finding and fixing vulnerabilities using AI – The OpenSSF Best Practices and AI/ML working groups released Finding and Fixing Software Vulnerabilities Using AI: A Guide for Developers, a free guide for developers and security researchers on using AI to find and fix vulnerabilities before attackers can exploit them. Built on principles that outlast any single tool, it covers the full process, from preparing and sandboxing AI to validating, fixing, and preventing issues, and stresses that AI-generated patches should never be trusted without automated tests and human review. An online course (LFD126) is planned for the coming months.
• Case study: GitHub expands malware advisories across eight ecosystems – A new case study shows how GitHub integrated OpenSSF’s Malicious Packages data into its Advisory Database, expanding Dependabot malware alerts beyond npm to eight package ecosystems, including PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer. The community-driven repository now holds more than 238,000 malicious package reports, showing how shared, open data can help defenders keep pace with fast-moving supply chain attacks.
• Zarf 1.0 marks a major milestone for the OpenSSF – the release helps teams package and deploy software in environments disconnected from the internet. Version 1.0 strengthens package signing and verification workflows, improves configuration management, and establishes a foundation for long-term compatibility and community-driven development.

Supporting Quotes

“Scanning tells you what went wrong. Knowing where your software came from tells you whether it should have been trusted at all. ActiveState builds open source from verified source so that secure is the default, and joining the OpenSSF is a natural next step in making that true for everyone who builds on open source.”
– Abby Kearns, CEO, ActiveState

“We think that you should be able to determine why things happen. Who, what, when, where, and how? Those questions can all easily be understood, but why is one of the hardest parts of cybersecurity. That’s why we made GoRapide open source, under an MIT license. We know why we build for our customers, but ultimately we can’t know every reason why someone might ask, ‘Why?’ For us, joining the Open Source Security Foundation made sense because open source is integral to our company mission.”
– Shane Morris, CEO, Beautiful Majestic Dolphin

“We built open-source DevGuard to make secure software development the default, not the exception. We already use OpenSSF projects and data to help our users secure their entire software development lifecycle, so joining the OpenSSF feels like a natural step. We’re proud to become part of the community shaping the future of open-source security and look forward to giving back.”
– Tim Bastin, CTO, DevGuard – L3montree GmbH

“Open source is the common ground the world’s digital economy is built on and India is now one of its largest builders. Keeping that ground secure isn’t one company’s or one country’s job; it belongs to all of us. UElement joins OpenSSF to help make it trustworthy today and quantum-safe tomorrow, so the systems people depend on, from banks to public infrastructure, can be built in the open and trusted everywhere.”
– Chaitanya Vijay Ghate, Co-founder & CEO, UElement Technologies

Events and Gatherings
OpenSSF members are gathering this week in Salt Lake City at Open Source SecurityCon North America and onsite at KubeCon + CloudNativeCon North America (November 9-12). Those interested in joining OpenSSF at events in 2027 should mark their calendars for Open Source SecurityCon Europe, which is planned for March 15, 2027.

Additional Resources

• View the complete list of OpenSSF members
• Contribute efforts to one or more of the active OpenSSF working groups and projects
• Sign up for the OpenSSF newsletter to receive updates on upcoming events, resources, and community news.

About the OpenSSF
The Open Source Security Foundation (OpenSSF) is a cross-industry organization at the Linux Foundation that brings together the industry’s most important open source security initiatives and the individuals and companies that support them. The OpenSSF is committed to collaboration and working both upstream and with existing communities to advance open source security for all. For more information, please visit us at openssf.org.

About the Linux Foundation 
The Linux Foundation is the world’s leading home for collaboration on open source software, hardware, standards, and data. Linux Foundation projects, including Linux, Kubernetes, Model Context Protocol (MCP), OpenChain, OpenSearch, OpenSSF, OpenStack, PyTorch, Ray, RISC-V, SPDX and Zephyr, provide the foundation for global infrastructure. The Linux Foundation is focused on leveraging best practices and addressing the needs of contributors, users, and solution providers to create sustainable models for open collaboration. For more information, please visit us at linuxfoundation.org.

The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see its trademark usage page: www.linuxfoundation.org/trademark-usage. Linux is a registered trademark of Linus Torvalds.

Media Contact
Grace Lucier
The Linux Foundation
pr@linuxfoundation.org 

View original content to download multimedia:https://www.prnewswire.com/news-releases/openssf-welcomes-new-members-and-expands-ai-security-resources-302932951.html

SOURCE OpenSSF