Open source is now a board-level issue. OTTRIA makes it manageable.
OTTRIA — the Open Source Trust, Threat and Risk Intelligence Alliance — is the European partner for your open source supply chain. New EU legislation holds management personally liable for securing their software supply chain. This includes every open source component in your organisation. OTTRIA closes this gap — with documented processes, measurable results, and audit-ready evidence.
Five laws, one responsibility #
DORA names open source analyses expressly as a test method for financial institutions (Art. 25(1)). Ultimate responsibility rests with the management body - personally, and it cannot be delegated.
NIS2 covers 18 critical infrastructure sectors. Supply chain security is mandatory (Art. 21(2)(d)). Fines up to EUR 10 million.
CRA requires CE marking, an SBOM and at least five years of security updates for products with digital elements. Fines up to EUR 15 million.
Product Liability makes software expressly a product. No liability cap - and anyone who fails to disclose requested evidence bears the burden of proof themselves.
GDPR requires security that reflects the state of the art, and it must last (Art. 32(1)). Unmaintained open source components undermine exactly that - fines up to EUR 10 million or 2% of worldwide annual turnover.
Open source is embedded in virtually every enterprise application. The new laws make you responsible — for every single component.
Why existing solutions fall short #
Scanners are a good first step. Catalogue providers help with selected projects. But a typical software bill of materials contains hundreds of entries.
- SCA tools find registered vulnerabilities — but fix none of them. And they miss silent fixes, which occur four to eleven times more frequently than registered CVEs. As long as nobody applies the fix, your system remains vulnerable — without you knowing.
- Catalogue providers support selected end products — such as an end-of-life framework or a legacy distribution. But not their dependencies. The hundreds of libraries those products depend on remain unmonitored — even though you are liable for them too.
- Enterprise support covers popular stacks — but not the thousands of small libraries that hold your software together. When one of those fails, your operations still grind to a halt.
Scanners are Layer 1: visibility. OTTRIA is Layer 2 and 3: intervention and governance.
Three pillars for your open source security #
Risk Intelligence We identify risks before they become public. Through our active participation in open source projects, we detect vulnerabilities, silent fixes, and project decay early — before the public CVE disclosure.
Operational Support We solve problems rather than just flagging them. When a vulnerability needs fixing, we coordinate the fix with the upstream project or create it ourselves. For abandoned projects, we ensure continued maintenance.
Compliance Enablement We deliver the evidence your auditor expects. Risk assessments, remediation histories, SBOMs with maintenance status — audit-ready for DORA, NIS2, and CRA.
Find your entry point #
Financial sector — DORA BaFin licence? Personal management liability and mandatory open source analyses affect you directly. Go to the DORA page
Critical infrastructure — NIS2 18 sectors, fines up to EUR 10 million, personal management liability. Go to the NIS2 page
Software manufacturers — CRA CE marking, at least five years of security support, 24-hour early warning for actively exploited vulnerabilities. Go to the CRA page
All software vendors — Product Liability Software is expressly a product. No liability cap — and anyone who fails to disclose requested evidence bears the burden of proof themselves. Go to the Product Liability page
Software service providers and agencies You develop software for clients? Then your role determines your obligations under CRA, Product Liability, DORA, and NIS2 — and whatever your client must contractually demand of you hits you either way. Go to the service provider overview
All enterprises — GDPR Everyone processes personal data. Art. 32 requires security that reflects the state of the art, and it must last — unmaintained open source components undermine exactly that. Your documented measures feed into how a fine is set under Art. 83(2)(d). Go to the GDPR page