When there’s a safety issue with a car or a child’s toy, the items usually get recalled and a fix is implemented. Some tech industry leaders are wondering why the same approach isn’t working for software.Log4j is a widely used open-source tool used to collect diagnostics data from applications written in Java. In late 2021, security researchers discovered that a critical flaw in Log4j could be used by hackers to breach vulnerable systems. The Apache Software Foundation quickly released a patch in December of that year, and additional fixes have been deployed since. Yet, vulnerable versions of the open-source tool continue to be downloaded around the world

Artificial intelligence has generated a lot of buzz around securing enterprise software and operations.However, a lingering inability to follow best practices and nail the fundamentals still plagues the industry at large, according to Brian Fox (pictured), chief technology officer of Sonatype Inc.“We have done some studies for years, and I think last year was our eighth year in a row,” he said. “The thing that I’ve been rattling on about since then is that around 96% of the time when organizations are pulling down vulnerable components, there’s already a fix available, which tells me that the problem is on the consumption side