The universe of open-source is vast and expanding. Understanding that universe is the job of NORAD, our big-data system that tracks and analyzes every single bit of open-source code that all of our users are consuming. Right now, this represents over 800 thousand unique libraries, over 6 million versions of those libraries and over 41 billion lines of code.
Instead of trying to dazzle you with machine learning jargon, we let the results speak for themselves. Over 90% of the security issues we add to our database are not present in other security databases at the time of entry. Our users have an unfair advantage.
Our dedicated security research team, the S-Force, is the human complement to our big-data system NORAD. The team tracks security chatter and turns it into signal.
For popular languages like Java, Python and Ruby we build a call-graph and trace the potential use of the vulnerable library to the actual line of code and determine true risk.