OpenSSF Expands Membership and AI Security Resources as Development Outpaces Security
The Open Source Security Foundation welcomed three new members and launched initiatives to help organizations secure software in an era where AI-driven development is accelerating faster than security practices can keep pace.
At Open Source SecurityCon North America on November 9, 2026, the Open Source Security Foundation announced it had brought three organizations into its fold: Beautiful Majestic Dolphin, DevGuard, and UElement Technologies. Alongside this membership expansion, the OpenSSF rolled out new resources aimed at bridging the growing gap between rapid AI-driven software development and the security measures needed to protect it.
The Foundation's latest initiatives include joining the Multi-Organization Secure AI Coordination (MOSAIC) group, publishing guidance on using artificial intelligence to identify and remediate vulnerabilities, and supporting research on how AI reshapes software security. These moves reflect an urgent challenge: as AI accelerates the pace of code production, the window between when bugs are discovered and when attackers can exploit them has narrowed dramatically.
"Security must keep pace with this new software development lifecycle," said Laura Guazzelli, Security Architect for AI/ML/LLM/Agentic Systems at OpenSSF. "This new SDLC has collapsed the window between bug discovery and automated attack, exposing defenses that are unprepared for AI-driven threats and offensive campaigns. This is why we are focused on equipping developers with practical resources, from guidance on finding and fixing vulnerabilities with AI to new data on how AI is shaping software development."
New Members and Their Mission
Beautiful Majestic Dolphin, DevGuard, and UElement Technologies join the OpenSSF as General Members, adding their expertise to a network of working groups and technical specialists focused on open source security. Their participation underscores the sector's commitment to ensuring the long-term viability of open source projects that underpin modern infrastructure.
Shane Morris, CEO of Beautiful Majestic Dolphin, noted that "Scanning tells you what went wrong. Knowing where your software came from tells you whether it should have been trusted at all. ActiveState builds open source from verified source so that secure is the default, and joining the OpenSSF is a natural next step in making that true for everyone who builds on open source."
Tim Bastin, CTO at DevGuard – L3montree GmbH, stated: "We built open-source DevGuard to make secure software development the default, not the exception. We already use OpenSSF projects and data to help our users secure their entire software development lifecycle, so joining the OpenSSF feels like a natural step. We're proud to become part of the community shaping the future of open-source security and look forward to giving back."
Chaitanya Vijay Ghate, Co-founder & CEO of UElement Technologies, emphasized that "Open source is the common ground the world's digital economy is built on and India is now one of its largest builders. Keeping that ground secure isn't one company's or one country's job; it belongs to all of us. UElement joins OpenSSF to help make it trustworthy today and quantum-safe tomorrow, so the systems people depend on, from banks to public infrastructure, can be built in the open and trusted everywhere."
Fourth Quarter 2026 Milestones
MOSAIC Membership
By joining MOSAIC, the OpenSSF can now coordinate with other member organizations to develop consistent standards and guidance for AI security. A key objective involves creating a standardized map of participating initiatives, aligning with frameworks such as NIST SP 800-53 Control SC-42, and establishing shared definitions across the group.
State of AI Impact on Software Security and Cybersecurity 2026 Report
Research conducted with support from OpenSSF, ActiveState, and the LF AI & Data Foundation revealed a significant disconnect between how quickly organizations deploy AI-driven development and their capacity to secure the resulting code. The study found that 58% of surveyed teams release code faster than their security review processes can evaluate it, while 60% reported that AI coding assistants have expanded the number of third-party packages in their software. These findings underscore why organizations need dependable, authoritative resources as they adopt AI tools.
Secure AI Associate Certification
The OpenSSF and Linux Foundation Education are introducing the Secure AI Associate (SAIA) credential, designed to teach practitioners how to identify and fix security risks throughout the AI and machine learning lifecycle, from data preparation through production deployment. The certification program becomes available in December 2026, with sign-up for exam notifications already open.
Vulnerability Detection and Remediation Guide
The OpenSSF's Best Practices and AI/ML working groups released Finding and Fixing Software Vulnerabilities Using AI: A Guide for Developers, a freely available resource for developers and security researchers. The guide walks through the complete workflow of using AI to discover and fix vulnerabilities before attackers can leverage them, emphasizing that patches generated by AI must always undergo automated testing and human review before deployment. An accompanying online course, designated LFD126, is in development.
GitHub Malware Advisory Expansion
A case study documents how GitHub incorporated OpenSSF's Malicious Packages dataset into its Advisory Database, enabling Dependabot to alert users about malware across eight package ecosystems: PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer. The community-maintained repository now contains over 238,000 reports of malicious packages, demonstrating how shared, transparent data strengthens defenses against supply chain attacks.
Zarf 1.0 Release
Version 1.0 of Zarf represents a significant achievement for the OpenSSF, providing teams with tools to package and deploy software in isolated, offline environments. The release enhances package signing and verification capabilities, refines configuration management, and creates a stable foundation for sustained compatibility and community-driven improvements.
Looking Ahead
Members of the OpenSSF are convening this week in Salt Lake City at Open Source SecurityCon North America and at KubeCon + CloudNativeCon North America (November 9-12). Those planning to participate in OpenSSF events during 2027 should note that Open Source SecurityCon Europe is scheduled for March 15, 2027.