News, media, and the public record.

OSERA Coverage

What the industry press is saying about OSERA — most recent coverage first.

The last mile of open source security should not be proprietary.

The same open source software runs the world's banks, insurers, hospitals, power grids and governments. It was built, and is largely maintained, in the open — by a global community, for everyone.

AI has not changed which vulnerabilities exist; it has changed how fast known ones are weaponised. A serious, well-funded response is arriving — much of it from individual vendors, each with its own approach. We welcome the investment and the urgency. But we have seen this pattern before: when something essential is fixed behind closed doors, access to the fix can quietly become a toll.

A network is only as safe as its weakest link. Keeping remediation open, portable, and consumable at scale is not idealism — it is sound risk management, and a neutral, sovereign alternative to depending on any one provider.

Fix it in the open. Keep it free. Let it move.

This is the neutral home for open source remediation in regulated environments, formed within FINOS and the Linux Foundation. Incubated in financial services, where the regulatory bar is highest, it is built to serve any regulated enterprise. We work in step with Akrites - the Linux Foundation's upstream security response initiative - and alongside the vendors building important tools. We are not here to compete with them. We are here to make sure their good work stays portable, verifiable, and free of lock-in for the institutions, and the public, that depend on it.

How open source security should work in the AI era

What we commit to — and what we ask

The Governing Board members are the institutions standing behind these principles. To add your institution, become a member or email membership@finos.org.