Which companies offer open source security?
Many different companies offer tooling, support, and security maintenance for open source software. Categories range from application security testing and vulnerability management to software supply chain security, cloud infrastructure security, and open source catalogs.
Learn more about the various segments of the open source security market and the key factors to consider when selecting a security provider or tech stack, including remediation, supply chain integrity, and developer experience.
What are the different market areas of open source security?
Open source security is spread across several general areas and categories. These include:
- Application security testing and scanning
- Vulnerability assessment and management
- Software supply chain security
- Cloud infrastructure security
- Open source catalogs
Security services can come directly from the vendor, as part of the base software or additional support, or can be provided by an independent third party. There are also different kinds of software (for example, a security scanner that inspects containers for vulnerabilities), and services (for example, providing security patches and support for software or specific packages).
Application security testing and scanning
This service aims to ensure that applications have been tested and scanned for security vulnerabilities and other issues. The primary objective of application security testing is to identify vulnerabilities within the source code and the open source libraries it depends on before the application is deployed. This can be done through two techniques:
- Software Composition Analysis (SCA), which identifies open source dependencies in manifests, lockfiles, and images and checks them for known vulnerabilities and license risks,
- Static Analysis (SAST), which examines the application's own source code for security flaws. Dynamic and interactive application security testing (DAST and IAST) complement these by testing the running application.
Modern approaches to application security testing increasingly use reachability analysis, a technique that determines if a vulnerable function within a library is actually accessible or executable by the application, thereby allowing developers to focus first on the risks most likely to be exploited.
Examples of providers in this area include Snyk, Aikido Security, Trivy, and Veracode.
Vulnerability assessment and management
Vulnerability management is a continuous operational cycle that involves detecting, categorizing, and remediating security weaknesses across all the layers of an organization’s applications, systems, and infrastructure. This process sometimes utilizes networked or agent-based scanners that inventory installed software and correlate versions with vulnerability data sources such as the NVD, OSV, and vendor security feeds.
In the context of Ubuntu environments, these platforms ingest Canonical’s vulnerability data feeds, helping prevent the reporting of "false positives" for vulnerabilities that have already been addressed by the OS vendor.
Examples of providers in this area include Qualys and Tenable.
Software supply chain security
Software supply chain security focuses on verifying the integrity and provenance of code, aiming to mitigate security and compliance risks that arise from the use of third-party software. Supply chain security can cover any layer of an organization’s software, tech stack, or infrastructure where the safety and security of components is vital.
Companies that provide this service may, for example, ensure that third-party components have had their integrity assessed, that the package has a verified origin, or that it does not contain known vulnerabilities or malicious code. This discipline often relies on SBOMs, build provenance (such as SLSA), digital signatures, and cryptographic attestations to verify that the software being deployed is exactly what was built and vetted in the CI/CD pipeline.
Examples of providers in this area include Black Duck, Endor Labs, JFrog, Seal Security, Snyk, and Socket.
Cloud infrastructure security
Cloud-Native Application Protection Platforms (CNAPP) offer a unified security framework that covers virtual machines, containers, orchestration, and the cloud control plane. These tools provide deep visibility into the stack that makes up their cloud infrastructure, monitoring the security of the host operating system alongside the configuration of Kubernetes clusters. CNAPP solutions also monitor user access and configurations.
Examples of providers in this area include Wiz, Prisma Cloud (Palo Alto Networks), and Aqua Security.
Open source catalogs
Open source catalogs provide a curated and verified alternative to public, unmanaged software repositories by offering security-maintained packages, such as pre-hardened container images and binaries. Providers of open source catalogs differ in their technical approach. For instance, for containers some offer "distroless" images that strip away everything but the essential runtime to minimize attack surface, while others use automated shrinking to remove unused code. Often, organizations will build their own internal catalog or registry using trusted artifacts provided by vendors.
Canonical, for example, provides security maintenance for the Main and Universe repositories in Ubuntu, providing backported security patches for the open source stack for up to 15 years through Ubuntu Pro. This enables developers to use security-maintained content from a trusted source. Canonical’s chiseled containers also offer a securely designed alternative with a smaller attack surface.
Examples of providers in this area include Canonical, Chainguard, RapidFort, and Red Hat.
How do you choose an open source security provider?
When choosing open source security vendors, the most important factors center on remediation capability, supply chain visibility, and alignment with upstream projects. A provider's value is measured by how effectively they help you to assess and fix security flaws, rather than raw numbers of vulnerabilities detected.
Most important factors in choosing open source security providers
Remediation vs reporting
Many tools identify vulnerabilities but leave the fix to you. Look for vendors that also offer remediation, backporting, and support. Ideally, the provider should offer you a way to apply security fixes across large numbers of machines without introducing regressions.
Supply chain integrity and provenance
With the rise of supply chain attacks, you must know exactly where your code comes from and be able to verify that it has not been tampered with.
- Your sources of open source packages should be curated to minimize risk.
- Ideally, software packages should be digitally signed so that you can verify their origin and integrity.
- A quality provider should give visibility into the latest vulnerabilities and changes in software.
- A quality scanner should also have a high level of interoperability with other third-party software scanners and data feeds to ensure that you know which vulnerabilities actually affect your specific configuration – this is because no scanner has universal coverage.
Depth of package coverage
Most providers only support the main packages within the software they provide or maintain. This is often insufficient at enterprise scale, as most enterprise risk lives in the thousands of community and third-party libraries that fall outside of this maintenance framework.
- The software provider should give broader security coverage, ensuring that their software works in a variety of environments, and that security fixes are compatible across various stacks without breaking existing setups and software environments.
- This coverage should be timely, and it should accommodate existing and legacy software and systems. Ideally, your packages should be security maintained for an extended period, going beyond traditional long-term support periods.
- Your security provider should help to maintain not just what you’re going to build, but the valuable software architecture and systems you’ve relied on for years. Options like Expanded Security Maintenance and Legacy add-on should give you a stable foundation to use established systems to their full value, while ensuring time and planning for a clearly communicated migration date.
Developer experience and friction
Security is only effective if it is proactive. Tools that create too much "noise" (false positives) or break production builds will be ignored by developers.
- The provider’s tools should integrate directly into existing CI/CD pipelines (GitHub Actions, GitLab CI).
- You should have access to exactly what you need, and no other superfluous software. For example, you should use chiseled and distroless options to remove unnecessary shells and package managers from container images, reducing the attack surface while keeping the image familiar for developers.
- Ideally, your chosen solution supports both in-place patching and a defined migration path, with clear end-of-support dates.
Security hardening and regulatory compliance
Regulations like the EU’s Cyber Resilience Act (CRA) and Digital Operational Resilience Act (DORA) place strict obligations on organizations that build or depend on open source components and software products.
- The ideal provider should make it easier to meet compliance requirements, for example through FIPS 140-3-validated cryptographic modules and hardening profiles aligned with CIS benchmarks and DISA STIGs.
- With the rising global interest in digital sovereignty, your chosen provider should give you options for owning, controlling, and directing your data, systems, and other digital elements, including where they are hosted and who can access them.
How does Canonical help with open source security?
Canonical plays a foundational role in enterprise open source security, by providing security maintenance, support, and compliance tooling for Ubuntu and a wide open source portfolio under Ubuntu Pro.
Canonical’s open source portfolio, with Ubuntu Pro covering the main layers (pictured in light orange).
Working with application security testing vendors
Canonical provides the securely designed foundation and runtime environment for applications that scanning tools examine, working with major software scanning vendors to ensure their solutions provide up-to-date and accurate scan results. Canonical does this by publishing machine-readable vulnerability data, such as OVAL and OSV feeds and Ubuntu Security Notices.
Vulnerability reporting, assessment, and management
Canonical manages the entire vulnerability lifecycle for the Ubuntu ecosystem, from initial triage to the distribution of patches and backported fixes. Through the Ubuntu CVE Tracker, Canonical provides continuously updated status on thousands of vulnerabilities, mapping them specifically to Ubuntu releases to reduce false positives in third-party scanners.
Organizations looking to further streamline vulnerability assessment and management can rely on Ubuntu Pro.
Ubuntu Pro provides:
- Comprehensive security coverage and timely patching across the entire Ubuntu landscape, including a vast repository of open source libraries and applications. Security fixes are backported to supported Ubuntu LTS releases, keeping package versions stable in enterprise environments.
- Minimized window of exposure and less manual work in security patching with solutions like Livepatch for critical and high priority kernel CVEs – making vulnerability management more efficient, reliable, and scalable.
- Access to Landscape, a centralized systems management solution to automate security audits and patch deployment across thousands of machines.
- Patching of specific CVEs through Ubuntu Pro’s
pro fixcommand.
Learn how Ubuntu Pro brings seamless security to open source ›
Software supply chain security
The Ubuntu archive’s metadata is cryptographically signed. APT verifies that signature, then follows a chain of hashes from the signed metadata to the package indexes and on to each downloaded package, authenticating its origin and integrity. Because packages come from a curated, managed archive rather than an unmanaged public repository, there is less exposure to tampered or look-alike packages.
Canonical also publishes its own vulnerability data. As a CVE Numbering Authority (CNA), Canonical can assign CVE identifiers within its scope, and it records the fixed status of each vulnerability per Ubuntu release through Ubuntu Security Notices and machine-readable OVAL and OSV feeds. Scanners and SBOM-based tools can use this data to see which package versions already contain a fix, rather than inferring it from upstream version numbers.
Open source catalogs
Canonical’s catalog is the Ubuntu archive, maintained as a single trusted source. Ubuntu Pro extends security maintenance from the Main repository to Universe, covering thousands of additional open source libraries and applications. Fixes are backported to supported LTS releases, so package versions stay stable up to 15 years.
For containers, chiseled images give you a minimal, security-maintained base. They contain only the files an application needs at runtime, with no shell or package manager by default, which reduces the attack surface and the number of components you have to scan.
Many organizations pair a vendor catalog with an internal registry. Ubuntu packages and chiseled images can serve as the trusted inputs to that registry, so your teams pull from a curated, verifiable source instead of from public repositories.
Compliance and hardening profiles
Besides providing proactive patching and backporting to ensure your systems remain stable for up to 15 years, Canonical provides compliance automation tools to apply hardening profiles at scale and help you comply with stringent regulations.
- Built-in compliance and hardening tools (like the Ubuntu Security Guide) automate the application of CIS and DISA STIG hardening profiles to help meet regulatory requirements (e.g., FedRAMP, PCI DSS).
- FIPS-certified cryptography, with access to FIPS 140-3-certified cryptographic modules, a mandatory requirement for highly regulated environments and government workloads.
Newsletter signup
Get the latest Ubuntu news and updates in your inbox.
Find out more
Explore how Canonical is at the vanguard of open source security. Dive deeper into our offerings, compare features, and get in touch to embrace the power of open source security for your entire stack for years to come.