Workstreams and available tooling

Where the work happens — in the open.

Three workstreams carry the alliance's mission: an open remediation standard so fixes are portable and verifiable, an open source Risk Navigator that allows firms to prioritize open source dependencies in their estates, and the road to regulated consumption at scale. All of it runs under the OSERA Guiding Principles — open, portable, and lock-in-free.

The workstreams Risk Navigator Guiding principles
The workstreams

Three streams, one mission

The alliance's workstreams are live and open. Any FINOS member can participate in the working groups — no OSERA membership required.

WS1 · ACTIVE — WORKING GROUP

Remediation Standards

One open standard so a fix from any producer is portable, verifiable and lock-in-free: it defines when a patched release is accepted into the OSERA repository — evidencing, signing, attestations, testing and conformance automation — aligned with Akrites, OpenSSF and the SCA ecosystem. Chaired by Dov Katz (Morgan Stanley).

WS2 · ACTIVE — SHARED TOOLING

Risk Navigator

Where shared prioritisation happens. Cross-firm demand, severity and exposure are scored on one neutral basis to order the shared remediation backlog — so machine-speed CVE waves are triaged automatically, not in committee.

WS3 · FUTURE FOCUS

Regulated Consumption at Scale

The next frontier: consuming fixes in time across a regulated estate — and proving it. Regulatory compliance evidencing and shared consumption tools and recipes, alongside FINOS CALM.

  • Consumption evidence, mapped to DORA, NIS2 & CRA
  • Shared tools & recipes for rollout at scale
  • Working group proposed for ratification next
  • Register your interest

How to participate

Working-group meetings and mailing lists are open to FINOS members only — but no OSERA membership is required. Not yet a member? Become a FINOS member.

Risk Navigator

Tooling available for prioritizing remediations in your estate

Risk Navigator is provided for firms to prioritize their input to the alliance: it turns dependency and vulnerability data into one risk centric remediation view — what is exposed, which projects are affected, and where upgrades or backpatches should be prioritised.

From vulnerable libraries to action

Use the overview to inspect vulnerable packages, CVEs, affected projects, safe versions, and backpatch candidates before bringing work into the OSERA formation process.

  • Rank libraries by CVSS, KEV, EPSS, project footprint, and upgrade path.
  • See which applications are directly or transitively exposed.
  • Identify candidates for upgrade guidance, OpenRewrite recipes, or backpatch work.
Open Risk Navigator See what's available now
Risk Navigator prioritization interface showing vulnerable libraries, CVEs, affected projects, and remediation details
The output feeds the alliance's shared backlog. Search the live catalog on The Solution. The timeline is below.
Where the work lives

Platform and projects, both in the open

Where the platform is built

Standards, tooling, and the exchange live in the FINOS OSERA organisation.

github.com/finos-osera →
Part of the collective Linux Foundation security response

Complementary to Akrites, by design

Akrites coordinates upstream security response; OSERA helps regulated enterprises operationalize remediation downstream.

Akrites · Linux Foundation

The upstream security response layer: coordinated vulnerability disclosure, remediation and upstreaming so fixes can reach open source projects responsibly.

OSERA · FINOS

The downstream operationalization layer: prioritization, standards, validation, back-patch sponsorship, vendor alignment, and rollout patterns for regulated enterprises.

Roadmap

From formation to a producer marketplace

A short public timeline. Current catalog figures are retrieved from the live OSERA platform when this page loads, with the source publication time shown below.

Loading published metrics…

Research

FINOS institutions recognise they each pay, independently, to keep the same open source dependencies alive — forking, patching or buying support for identical CVEs.

Spearheaded by Moderne, the effort is brought to the FINOS community — in the open, not as a product — and a formation group convenes.

A working pipeline ships: critical Java lines maintained as backpatch releases and validated end-to-end by participating banks.

The Linux Foundation launches Akrites, the upstream security response layer. Read the announcement.

Formation

FINOS announces the intent to form OSERA.

OSERA becomes operational. Citi, Deutsche Bank, Morgan Stanley, NatWest and RBC sign as founding Premier members. The first Governing Board convenes, and the Remediation Standards working group is ratified.

Startup

Remediation Standards pack 0.1.0 ratified. Read the pack.

First supported ecosystem, Java, and the first maintained lines. Spring Boot, Framework, and Security are the featured lines. The narrative list is in the prospectus.

Current published catalog

Live catalog: — libraries, — with fixes, — patched entries. Ecosystems published now: loading….

Per-project sponsorship, further ecosystem coverage, and version 0.2.0 of the Remediation Standards with the next attestations.

Scaling

Multiple producers, the full exchange model, and bring-your-own maintainer or contractor. This is the open producer marketplace, including open source AI-driven remediation.

Ready to roll up your sleeves?

Tech vendors join the working groups and bid to maintain through FINOS membership. Financial institutions fund and govern through OSERA membership. And because every line is open source, anyone can build it themselves.

Become a FINOS member Become an OSERA member Build it yourself