Become an OpenSSF Ambassador

OpenSSF Newsletter – March 2026

By March 26, 2026

TL;DR:

7 mins read

OpenSSF Celebrates New Members, No-Cost Tooling, and Project Milestones

Announced at Open Source SecurityCon Europe, the OpenSSF welcomes Helvethink, Spectro Cloud, and Quantrexion as its newest members. This update also highlights the release of the Kusari Inspector as a no-cost tool for OpenSSF projects to help maintainers visualize and secure their software supply chains. Read more.

Leading Tech Coalition Invests $12.5 Million Through OpenSSF and Alpha-Omega to Strengthen Open Source Security

A major coalition including Anthropic, Amazon Web Services (AWS), GitHub, Google, Google Deep Mind, Microsoft, and OpenAI has committed $12.5 million in new funding. Managed by the Alpha-Omega project and OpenSSF, this investment aims to improve sustainable security solutions, focus on vulnerability remediation, and address the security of the AI ecosystem. Read the blog to learn more.

Introducing the OpenSSF Ambassador Program

The OpenSSF has officially launched the Ambassador Program, a global initiative to empower community leaders to promote secure development practices. Ambassadors will play a key role in mentoring others, contributing to working groups, and representing the Foundation at industry events worldwide. Learn more about the program and apply now.

Kusari Partners with OpenSSF to Strengthen Open Source Software Supply Chain Security

In a new partnership, OpenSSF member Kusari is providing its Inspector tool to OpenSSF project maintainers for free. This tool integrates directly into development workflows to provide real-time insights into dependencies, helping teams catch vulnerabilities and licensing issues before code is merged. Learn more.

KubeCon + CloudNativeCon Europe 2026 Co-located Event Deep Dive: Open Source SecurityCon

Taking place in Amsterdam, Open Source SecurityCon brings together the cloud-native community to tackle the most pressing threats in the software supply chain. The event features deep dives into AI security, policy, and collaborative tools for maintainers and operators. Read the Open Source SecurityCon Europe deep dive from OpenSSF community members Brandt Keller (Defense Unicorns) and Constanze Roedig.

Securing Agentic AI in Practice: From OpenSSF Guidance to Real-World Implementation

As AI agents gain more autonomy, new risks emerge. This post talks about how the recent OpenSSF Tech Talk: Securing Agentic AI in Practice: From OpenSSF Guidance to Real-World Implementation explores the implementation of the SAFE-MCP framework and provides practical guidance on managing trust, provenance, and secure interactions between AI models and users. The Tech Talk on-demand is now available to watch and the slide deck is available to download. 

First Steps Towards Cyber Resilience Act Conformity: Biking the CRA with Balena at FOSDEM 2026

Following a presentation at FOSDEM 2026, OpenSSF community member Harald Fischer (balena) uses a bicycle metaphor to break down the complexities of the EU Cyber Resilience Act (CRA). It offers a practical introduction to cybersecurity risk management and the steps projects must take to achieve conformity. Read the blog.

Introducing the Gemara Model

GemaraOpenSSF community members Eddie Knight (Sonatype), Hannah Braswell (Red Hat), and Jenn Power (Red Hat) introduce Gemara, a seven-layer model for Governance, Risk, and Compliance (GRC) engineering. Much like the OSI model for networking, Gemara aims to bridge the gap between compliance officers and engineers by providing a standardized framework for automated risk assessment. Learn more about Gemara.

Your Voice Belongs Here: How to Get Involved in the OpenSSF Community

Are you new to the foundation? This guide outlines the various “User Journeys” available to contributors. Whether you are a developer looking to join a Working Group (like Best Practices or Supply Chain Integrity) or a security researcher, this post explains how to start making an impact. Read the blog and start your journey with OpenSSF here.

Case Study: Defending the Open Source Supply Chain in a New Regulatory Era

This case study examines the intersection of security and policy, specifically looking at how OpenSSF’s Premier Member Red Hat and the OpenSSF are navigating new global regulations. It provides a roadmap for how organizations can maintain compliance while fostering a vibrant and secure open source ecosystem. Read the Case Study.

What’s In the SOSS? An OpenSSF Podcast 

What’s in the SOSS? Podcast #57 – S3E9 From Noise to Signal: Security Expertise and Kusari Inspector with Mike Lieberman

In this episode, CRob talks with Mike Lieberman from Kusari about the current state of open source security. They discuss the growing burden on maintainers from the “deluge” of noisy, low-quality vulnerability reports, often generated by AI tools, and the vital role of “a human in the loop.”

What’s in the SOSS? Podcast #56 – S3E8 Empowering New Maintainers: Inside the OpenSSF Mentorship Program

In this episode of What’s in the SOSS? host Sally Cooper sits down with Yesenia Yser, co-lead of the OpenSSF Mentorship Program and the BEAR Working Group, and Kairo De Araujo, Open Source Software Engineer and mentor for rstuf. They dive into the success of the OpenSSF Mentorship Program, which focuses on bringing underrepresented voices into software security.

What’s in the SOSS? Podcast #55 – S3E7 The Gemara Project: GRC Engineering Model for Automated Risk Assessment

Hannah Braswell and Jenn Power, Security Engineers from Red Hat and contributors to the OpenSSF, join host Sally Cooper to discuss the Gemara project. Gemara, an acronym for GRC Engineering Model for Automated Risk Assessment, is a seven-layer logical model that aims to solve the problem of incompatibility in the GRC (Governance, Risk, and Compliance) stack.

News from OpenSSF Community Meetings and Projects:

Upcoming community meetings

In the News:

Meet OpenSSF at These Upcoming Events!

Ways to Participate:

There are a number of ways for individuals and organizations to participate in OpenSSF. Learn more here.

You’re invited to…

See You Next Month! 

We want to get you the information you most want to see in your inbox. Missed our previous newsletters? Read here!

Have ideas or suggestions for next month’s newsletter about the OpenSSF? Let us know at marketing@openssf.org, and see you next month! 

Regards,

The OpenSSF Team