--- title: "Announcing the Private Beta of FOSSA Risk Intelligence" description: "Introducing FOSSA Risk Intelligence, a private beta add-on to enhance software supply chain security by addressing risks like stale packages, abandonware, and more." canonical_url: "https://fossa.com/blog/announcing-private-beta-risk-intelligence/" markdown_url: "https://fossa.com/blog/announcing-private-beta-risk-intelligence.md" content_type: "blog" language: "en" date_published: "2022-07-06" date_modified: "2022-07-06" author: "Gauthami Polasani" organization: "FOSSA" --- # Announcing the Private Beta of FOSSA Risk Intelligence > Introducing FOSSA Risk Intelligence, a private beta add-on to enhance software supply chain security by addressing risks like stale packages, abandonware, and more. More than 90% of organizations use open source in their applications, and with good reason. But along with a multitude of benefits, open source does carry license compliance and security risks. Traditionally, open source vulnerability management tools (like [software composition analysis](https://fossa.com/complete-guide-software-composition-analysis)) have largely focused on identifying and mitigating CVEs (Common Vulnerabilities and Exposures). But it is becoming increasingly clear that focusing on CVEs — without accounting for other security risks impacting open source — can leave organizations vulnerable. As recent [supply chain attacks](https://fossa.com/blog/defend-against-software-supply-chain-attacks.md) have proven, the surface area of attacks has expanded, with bad actors finding novel attack vectors to infiltrate and inject malware into applications. These include: **Stale Packages**: This refers to the scenario where an organization uses a package that is a number of versions behind the current version. This can leave it susceptible to vulnerabilities. **Abandonware**: A package is considered abandoned when it hasn’t been updated for an extended period of time or the maintainer(s) are no longer responsive. This signals that maintainers are likely not going to patch bugs or introduce new features. If there is a vulnerability in this package, it is unlikely to be patched. **Native Binary Code**: These binaries can be used as a vector to cause potentially malicious behavior. **Empty Packages**: Dependencies that do not contain any code, which may be indicative of: - A package that has been removed from a registry - A package that's been misconfigured or erroneously published - Name squatting While these are not immediately concerning, it is possible that an author can use these to publish a version with malicious code at a later date. The CVE mechanism isn’t set up to handle these novel types of security gaps that can cause various security risks. Teams need a more proactive approach to identify and mitigate these risks and strengthen [software supply chain security](https://fossa.com/software-supply-chain-security). ## Introducing FOSSA Risk Intelligence We are excited to announce the private beta of our Risk Intelligence add-on to harden your software supply chain. This add-on provides proactive and comprehensive defense to your applications against sophisticated attack vectors that cannot be addressed via CVEs. Teams are able to identify and address operational risks in their software supply chain like: - Stale Packages - Abandonware - Empty Package - Native Code **Stale Packages**: Users can configure how many major and minor versions behind the latest version of the package is acceptable to your organization. This will ensure that there are no stale or outdated packages for any of your dependencies. You can also use this to ensure that your applications are using the latest/safest version of any library. **Empty Packages**: Enabling this signal within the security policies ensures that packages with no code will be marked as risky, so you can keep them out of software. **Abandonware**: Users are notified if their projects have abandoned packages (defined as not being updated in two-plus years). **Native Code**: Customers are alerted about any unexpected executables within their packages. ## Bring Risk Intelligence to Your Organization FOSSA Risk Intelligence is currently in private beta, and we encourage Vulnerability Management users on business and enterprise plans to consider joining. Please [sign up to be a part of the beta here](https://fossa.com/lp/risk-intelligence-addon#Risk-Beta-FF), and contact us with any questions or feedback at [support@fossa.com](mailto:support@fossa.com). We look forward to working with beta members to ensure we continue to build functionality that meets their needs and provides significant value. ## Related resources - [Analyzing 5 Major OSS License Compliance Lawsuits](https://fossa.com/blog/analyzing-5-major-oss-license-compliance-lawsuits.md): Learn about five lawsuits that have helped shape global enforcement of open source software licenses. - [May 2025 FOSSA Product Updates](https://fossa.com/blog/may-2025-product-updates.md): Learn about several recent FOSSA product updates, including container scanning and CycloneDX report improvements. - [Annotate Dependencies with Context: Introducing Package Labels in FOSSA](https://fossa.com/blog/annotate-dependencies-context-introducing-package-labels.md): Introducing FOSSA Package Labels - a powerful way to annotate packages with contextual metadata, enabling more efficient and insightful reporting and filtering. - [License Compliance, SBOM, and Vulnerability Management for Smaller Teams: FOSSA Business Tier](https://fossa.com/blog/fossa-business-tier.md): FOSSA introduces a new business tier tailored for smaller teams, offering flexible pricing and comprehensive features for SBOM, vulnerability management, and license compliance. - [Fall 2024 Software Licensing Roundup](https://fossa.com/blog/fall-2024-software-licensing-roundup.md): Explore the significant licensing stories of fall 2024, including Elastics return to open source, the new fair source licensing model, and the PearAI controversy. ## Source Canonical page: https://fossa.com/blog/announcing-private-beta-risk-intelligence/