SOSS Community Day Europe
2024-09-19 08:00 - 17:00 UTC | Austria Center Vienna, Bruno-Kreisky-Platz 1, 1220 Wien, Austria
Secure Open Source Software (SOSS) Community Days are an opportunity for Community Members from across the Security and Open Source ecosystem to get together and share ideas and progress on capabilities that make it easier to sustainably secure the development, maintenance, and consumption of the open source software (OSS) we all depend on. SOSS Community Days are held regionally, alongside the Open Source Summits and were formerly called OpenSSF Days. The change in name reflects the need to capture the broader interest in the security of open source software. What’s in the SOSS? Come to a Community Day to find out! Brought to you by OpenSSF.

Nordic Software Security Summit
2024-09-23 - 2024-09-24
Attending: OpenSSF is attending the Nordic Software Security Summit this fall! This is the new conference on application security, focusing on the new EU legislation for software.

Keyfactor Meeting
2024-09-26
Attending: We’re attending the 2024 Keyfactor Community Tech Meetup in Stockholm this September.
This event is inviting engineers and security specialists from Stockholm, the Nordics and around the world. Prepare yourself for an immersive experience filled with engaging presentations, hands-on workshops, and demos.

Grace Hopper
2024-10-08 - 2024-10-11
Attending: Join OpenSSF and our community at the Grace Hopper Celebration this October. Come to this event and feel empowered, encouraged and inspired. You will be hearing from experts talking about their career growth, technical upskilling, leadership, DEI, and more.

SOSS Fusion Conference
2024-10-22 - 2024-10-23
Hosting: The OpenSSF is hosting the SOSS Fusion Conference this year. The Secure Open Source Software (SOSS) Fusion Conference is a premier event, from OpenSSF, where the brightest minds in software development and cybersecurity converge as one community committed to securing the open source software that we all depend on. SOSS Fusion will host in-depth technical conversations on innovative and industry leading ways to secure open source software, fostering a collaborative platform for cutting-edge solutions and security insights.

Open Source Summit Japan
2024-10-28 - 2024-10-29
Attending: Catch us in Japan at the OSS Japan! Open Source Summit Japan is the leading conference in Japan connecting the open source ecosystem under one roof, providing a forum for technologists and open source industry leaders to collaborate and share information, learn about the latest in open source technologies and find out how to gain a competitive advantage by using innovative open solutions.

SOSS Community Day Japan
2024-10-30
Hosting: Co-located with OSS Japan, OpenSSF is hosting another SOSS Community Day in Japan. Stay tuned for more details.

SigstoreCon North America
2024-11-12
Attending: OpenSSF is attending the 2024 SigstoreCon North America on November 12! Sigstore is a new standard for signing, verifying, and protecting software. Sigstore ensures that your software is all that it claims to be for developers and end users. SigstoreCon is a one-day vendor neutral conference organized by the Sigstore community and focused on all things Sigstore. Join us in Detroit and accelerate how you secure your software supply chain.

Linux Foundation Member Summit
2024-11-19 - 2024-11-21
Attending: The OpenSSF will be at the Linux Foundation Member Summit (LFMS) this year! The LFMS is the annual gathering for Linux Foundation member organizations that fosters collaboration, innovation, and partnerships among the leading projects and organizations working to drive digital transformation with open source technologies.

Policy, Security, and the Software Supply Chain
2024-11-27 14:00 - 15:00 (Asia/Kolkata)
﻿
Join us for a live stream with security expert Abhisek Datta! Abhisek has over a decade of experience in platform & security engineering, DevSecOps, and building secure B2B SaaS platforms.
In this session, Abhisek will discuss the critical intersection of policy, security, and the modern software supply chain. He’ll also demonstrate vet, an open-source tool he co-developed to identify risks in open source dependencies, helping engineering and security teams leverage DevSecOps and policy-as-code practices to build more secure software.
Don’t miss this opportunity to learn:

The evolving landscape of software supply chain security.
How to identify and mitigate risks in open source dependencies.
Practical strategies for integrating security into your DevSecOps workflow.
A live demo of vet, a new tool for securing software supply chains.
The impact of the work OpenSSF has been doing within the larger security community.

Mark your calendars and join the live stream!
This event is being hosted in the run up to SOSS Community Day, India, co-located with KubeCon + CloudNativeCon India 2024. Please remember to register for the event here.

Building Security Tooling: Trials and Triumphs
2024-11-28 14:00 - 15:00 UTC
Join Barun Acharya, who is many things ― a CNCF Ambassador, maintainer for KubeArmor, and works as a Software Engineer at Accuknox, as he gives us the inside story of what it is like to build and maintain security tooling. In his conversation, he will be explaining the common pitfalls one can expect when designing security tooling and the difficult decisions developer habits put them in.
If you’ve wondered how to strike a balance between building opinionated tooling that sets out to accomplish something versus being an open platform for developers, this live stream is certain to spark your interest. Join us to learn more about security, tooling, and the challenges that surround security awareness.

SOSS Community Day India
2024-12-10
Hosting: Join us in Delhi, India this December! Secure Open Source Software (SOSS) Community Days are an opportunity for Community Members from across the Security and Open Source ecosystem to get together and share ideas and progress on capabilities that make it easier to sustainably secure the development, maintenance, and consumption of the open source software (OSS) we all depend on. This year, we’re bringing our favourite community event to India. RSVP now!

Meetup: Global Cyber Policy WG at FOSDEM 2025
2025-02-02
Join the OpenSSF community at FOSDEM in Belgium, Brussels on Sunday, 2 February for a Global Cyber Policy WG Meetup!
It’s an informal gathering where you can meet some of your fellow security contributors working on CRA collaboration efforts.
Location: We will gather at the CNCF / LF Europe stand (K2-A-16 – Building K, Level 2, #16) and then find an open table to meet.
Important Note: There are two meeting times to accommodate schedule conflicts with DevRooms, etc. 14:00 and 17:00.
Add February 2 – 14:00 to Your Calendar
Add February 2 – 17:00 to Your Calendar

Livestream: All About SaaS Security
2025-02-06 14:00 - 15:00 (Asia/Kolkata)
Join us for a live stream with Aparna Hinge, Principal Product Manager at CheckRed, as she shares her extensive experience in securing SaaS applications. With over 15 years in building secure software, including 10 years in groundbreaking security research and product design, Aparna brings a wealth of knowledge to the table. As a Certified Information Systems Auditor (CISA), she possesses deep expertise in technical areas coupled with governance and policy requirements. This allows her to navigate the complexities of SaaS security with aplomb!
In this captivating session, Aparna will pull back the curtain on the often-hidden world of SaaS security, sharing firsthand accounts of the challenges she’s conquered and the intricate technical puzzles she’s solved while architecting robust security for the applications we rely on every day. Discover the nuances of safeguarding SaaS environments and glean invaluable wisdom from a true industry veteran.
CheckRed’s comprehensive security posture management (SSPM + CSPM) approach delivers a streamlined, centralized cloud security solution, providing comprehensive coverage across major cloud providers like AWS, Azure, GCP, and Linode, as well as over 50 widely used SaaS applications, including Salesforce, Microsoft 365, ServiceNow, and Okta.
Remember to join us live on Thu, Feb 6th, 2025!

Live stream: Sparks Fly, When Security Meets AI
2025-02-13 14:00 - 15:00 (Asia/Kolkata)
AI is now everywhere! But how prepared are we to protect our data, models, and defend other assets?
Join us for a special episode of our live streams where we explore the critical intersection of open source security and artificial intelligence. We’ll delve into the lack of security measures protecting AI systems and the urgent need to address the growing needs. This stream will help you gain an understanding of the vast attack surface in AI, from data poisoning and model theft to adversarial attacks and malicious code injection. It will also educate you about the potential risks of running untrusted AI/ML models, which would lead to attacks including cryptojacking, remote code execution, and data breaches.
This live stream features special guest Keerthana Rampa, who is an Associate Project Manager at AccuKnox. She is a leading expert in AI security and will share her deep knowledge and insights on the challenges and solutions in this rapidly evolving field.

OpenSSF Policy Summit DC 2025
2025-03-04
Hosting: OpenSSF Policy Summit is coming to DC on March 4, 2025! This event addresses the security challenges for the consumption of Open Source Software (OSS) in critical infrastructure sectors and beyond. The event is hosted by the Open Source Security Foundation (OpenSSF), an initiative of the Linux Foundation. Learn more about the event: https://events.linuxfoundation.org/openssf-policy-summit-dc/

Beyond the SBOM: Ensuring Integrity with Attestations
2025-03-05
The “Beyond the SBOM: Ensuring Integrity with Attestations” event, hosted by the SBOMit community, seeks to raise awareness about the limitations of single SBOMs and even signed SBOMs in ensuring software supply chain security. This summit will highlight the critical role of attestations in verifying and enhancing SBOM integrity, featuring talks from industry leaders and breakout sessions to foster collaboration and innovation in the field.

Linux Foundation Member Summit
2025-03-18 - 2025-03-20
Attending: The OpenSSF is attending the Linux Foundation Member Summit 2025. This event is the annual gathering for Linux Foundation member organizations. An annual gathering for Linux Foundation members that fosters collaboration, innovation, and partnerships among the leading projects and organizations working to drive digital transformation with open source technologies. It is a must-attend for business and technical leaders looking to advance open source strategy, implementation, and investment in their organizations and learn how to collaboratively manage the largest shared technology investment of our time.

Building A Diverse Understanding About Open Source Security with Arjun BM
2025-03-27 14:00 - 15:00 UTC
Dive Deep into the World of Cyber Security with Arjun BM, who is presently serving as the Head of Security at a global retail organization!
Join us for an exclusive live stream with the award-winning cyber security leader, Arjun BM! With over 20 years of experience having worked with cybersecurity within various domains, Arjun brings unparalleled insights into the ever-evolving landscape of digital threats.
In what is expected to be an engaging session, Arjun will delve into the following critical areas:
Security in Retail: Explore the unique challenges and strategies involved in safeguarding digital storefronts from various malicious actors.
Software Supply Chain Security: Uncover the vulnerabilities and best practices for securing the software supply chain in today’s interconnected world.
The India Cybersecurity Situation: Gain a deep understanding of the current cybersecurity landscape in India, including emerging threats and opportunities.
Don’t miss this opportunity to learn from a seasoned expert and get your burning cyber security questions answered live!
Arjun on LinkedIn

FIRST VulnCon 2025
2025-04-07 - 2025-04-10
Sponsoring: OpenSSF is sponsoring and attending the 2025 Vulnerability Management Ecosystem Collaboration, Ideation, and Action Conference (aka “VulnCon”) Also sponsored by FIRST and the CVE Program. The conference will take place April 7th through 10, 2025. The location for the event will again be the North Carolina State University, McKimmon Center.
The purpose of the conference is to collaborate with various vulnerability management and cybersecurity professionals to develop forward leaning ideas that can be taken back to individual programs for action to benefit the vulnerability management ecosystem. A key goal of the conference is to understand what important stakeholders and programs are doing within the vulnerability management ecosystem and best determine how to benefit the ecosystem broadly.
VulnCon is Co-Hosted by FIRST and the CVE Program. This event will be open to both FIRST members and non-members around the world who are part of the vulnerability ecosystem.

RSA Conference
2025-04-28 - 2025-05-01
Attending: The OpenSSF is attending the RSA Conference 2025. Join us in San Francisco from April 28 to May 1. At RSAC™ 2025, you’re not just attending a conference—you’re stepping into a vibrant, thriving community of thinkers, innovators, and achievers. Though we come from different corners of the cybersecurity world, we are united by a common mission: to foresee risks, counter threats, and embrace the challenges ahead. Together, we shape the future of security. Together, we shine as one.

Threat Hunting With(in) Open Source
2025-05-27 14:00 - 15:00 UTC
Threat hunting in cybersecurity is a proactive and iterative process of searching through networks, endpoints, and datasets to detect malicious, suspicious, or risky activities that have evaded existing security defenses. Unlike traditional security measures that react to known threats or alerts, threat hunting assumes that adversaries may already be present in the environment and actively seeks them out using a combination of skilled human analysis and technology. Open source plays a significant role in the realm of threat hunting. Many powerful tools used for data collection, analysis, and visualization in threat hunting are open source, providing cost-effective and customizable options for security teams.
In this informative session, Rohit Sadgune takes us through his experience with threat hunting, with a healthy dose of OSS. Join us live on May 27th at 2 pm IST.

Introduction To The OpenSSF
2025-05-29 20:00 - 21:00 UTC
Often asked question ― What can be wrong with open source, that I need to secure it?
This session will provide answers. Along with a comprehensive overview of the vital work being done by the OpenSSF to address these critical challenges head-on. We will explore the landscape of key OpenSSF projects and initiatives, designed to identify, fix, and prevent security vulnerabilities in open source software. Learn how the OpenSSF community is working collaboratively to build a more secure open source supply chain for everyone. Whether you’re a developer, security professional, or simply sit downstream in open source ―― understanding the OpenSSF is crucial in navigating the future of software security.
Join us for a live stream introducing the Open Source Security Foundation (OpenSSF), a cross-industry collaboration dedicated to improving the security of the open source software ecosystem. As open source adoption accelerates globally, so too do the associated security risks, creating widening “chasms” that malicious actors can exploit. This increasing reliance on open source components means that vulnerabilities can have a significant “blast radius” across diverse applications and industries.
Tune in to learn how you can benefit from and contribute to a more secure open source world.

Zero Trust Network Access
2025-06-03 14:00 - 15:00 (Asia/Kolkata)
Presented by Tushar Anand, an experienced Security Engineer specializing in cloud security, application security, and compliance, with extensive skills in pentesting and risk management.
In today’s evolving threat landscape, traditional perimeter-based security is no longer sufficient. This talk, “Zero Trust Network Access,” will delve into the fundamental principles of Zero Trust and its critical role in modern network security. We will explore how assuming “never trust, always verify” can drastically enhance your organization’s security posture.
Tushar will guide you through the core concepts of Zero Trust Network Access (ZTNA) and discuss its relationship with broader network security practices. A key highlight of this session will be a demonstration of Qryptic, an open-source tool built by Tushar to practically illustrate ZTNA principles in action. This will provide valuable insights into how open source can empower security professionals to implement and understand complex security models. Join this session to deepen your understanding of ZTNA, explore practical open-source solutions, and learn how to commit to safeguarding your digital environments in an increasingly complex world.

Open Source LLM Security
2025-06-14 14:00 - 15:00 (Asia/Kolkata)
As Large Language Models (LLMs) become increasingly prevalent, the security of their open-source variants presents unique and critical challenges. While offering flexibility and accessibility, the open nature of these models can expose them to specific vulnerabilities and attack vectors. This talk will explore the emerging security landscape surrounding open-source LLMs, discussing risks such as data poisoning, model inference attacks, and supply chain compromises. Understanding these threats is vital for developers and users to leverage LLMs safely and effectively. We will delve into key security considerations and potential mitigation strategies for building and deploying secure open-source LLM applications.

OpenSSF Community Day Japan
2025-06-18
Hosting: OpenSSF Community Days bring together a vibrant community from across the Security and Open Source ecosystems to share ideas and progress on capabilities that make it easier to sustainably secure the development, maintenance, and consumption of the software on which we all depend. These events, held regionally and co-located with KubeCon or Open Source Summits, offer an opportunity to engage with the brightest minds in security for a day of collaboration and innovation in software security best practices. As a home for tools, standards, and education, OpenSSF provides attendees the chance to explore these resources, share their experiences, and contribute to a safer and more secure digital world.

Open Source Summit: North America
2025-06-23 - 2025-06-25
Sponsoring: OpenSSF is sponsoring another Open Source Summit this year! Open Source Summit is the premier event for open source developers, technologists, and community leaders to collaborate, share information, solve problems, and gain knowledge, furthering open source innovation and ensuring a sustainable open source ecosystem. It is the gathering place for open-source code and community contributors. Be sure to visit our booth and say hi to the community!
Visit the OpenSSF Booth #B7 in the Exhibit Hall for live demos, swag, and conversations with the community powering open source security.
OpenSSF Booth Schedule
Monday, June 23 (all times MT)
10:30 a.m. – 11:30 a.m.: Zarf
11:30 a.m. – 12:30 p.m.: Zarf
12:30 p.m. – 1:30 p.m.: Model Signing
1:30 p.m. – 2:30 p.m.: Scorecard, Allstar, GUAC
3:30 p.m. – 4:30 p.m.: Scorecard, Allstar, GUAC
Tuesday, June 24
10:30 a.m. – 11:30 a.m.: Zarf, OpenVEX
11:30 a.m. – 12:30 p.m.: bomctl, Protobom
12:30 p.m. – 1:30 p.m.: Securing Project Repos with OSPS Baseline
1:30 p.m. – 2:30 p.m.: BEAR
2:30 p.m. – 3:30 p.m.: Baseline Compliance with OpenSSF Projects
3:30 p.m. – 4:30 p.m.: Sigstore, Scorecard, Allstar, GUAC
4:30 p.m. – 5:30 p.m.: Scorecard, Allstar, GUAC
5:30 p.m. – 6:30 p.m.: gittuf
Wednesday, June 25
10:20 a.m. – 11:30 a.m.: BEAR
11:30 a.m. – 12:30 p.m.: Automated Governance with ORBIT, Zarf
12:30 p.m. – 1:30 p.m.: Zarf, SLSA Source
1:30 p.m. – 2:10 p.m.: gittuf

OpenSSF Community Day NA 2025
2025-06-26
Hosting: OpenSSF community, join us in Denver this summer! OpenSSF Community Days are hosted regionally, they are an opportunity for Community Members from across the Security and Open Source ecosystem to get together and share ideas and progress on capabilities that make it easier to sustainably secure the development, maintenance, and consumption of the open source software (OSS) we all depend on. Mark your calendar and get ready to meet & connect with the community!

Blackhat USA 2025
2025-08-02 - 2025-08-05
Attending: Join us as we attend Blackhat USA this year in Las Vegas!

Black Hat USA returns to the Mandalay Bay Convention Center in Las Vegas with a 6-day program. The event will open with four days of specialized cybersecurity Trainings (August 2-5), with courses for all skill levels. Also taking place during Black Hat USA is Summit Day on Tuesday, August 5, followed by the two-day main conference on August 6 & 7 featuring more than 100 selected Briefings, dozens of open-source tool demos in Arsenal, a robust Business Hall, networking and social events, and much more.

OpenSSF Community Day India
2025-08-04
Hosting: Join us for the OpenSSF Community Day India this summer! Co-located with KubeCon + CloudNativeCon India, this event will bring the open source community together in Hyderabad, India.
About OpenSSF Community Days: OpenSSF Community Days bring together a vibrant community from across the Security and Open Source ecosystems to share ideas and progress on capabilities that make it easier to sustainably secure the development, maintenance, and consumption of the software on which we all depend. These events, held regionally and co-located with KubeCon or Open Source Summits, offer an opportunity to engage with the brightest minds in security for a day of collaboration and innovation in software security best practices. As a home for tools, standards, and education, OpenSSF provides attendees the chance to explore these resources, share their experiences, and contribute to a safer and more secure digital world.
