Report by Black Duck
“2025 Open Source Security and Risk Analysis” Report
Key Findings
91% of audited applications contain outdated open source software components.
86% of audited applications contained open source vulnerabilities, with 81% containing high- or critical-risk vulnerabilities.
64% of open source components were transitive dependencies.
56% of all audited applications had license conflicts.
97% of all applications evaluated contained open source software.
90% of the applications contain components more than 10 versions behind the most current version.
The number of open source files in an average application has tripled over the last four years.
Nearly 30% of component license conflicts were caused by transitive dependencies.
33% had open source software components with no license or a customized license.