--- title: "Building Security in Open Source for Financial Services: OpenSSF at OSFF" description: Financial services run on open source. With regulations growing and supply chains under pressure, institutions need clear frameworks and reliable data to keep systems secure. At the Open Source in Finance Forum (OSFF) the OpenSSF community is sponsoring and sharing sessions on the OSPS Baseline, vulnerability data, and AI security. These talks demonstrate how our community is making open source more secure and useful to financial services. image: https://www.finos.org/hubfs/Community%20Blog/2025-10-07%20-%20Building%20Security%20in%20Open%20Source%20for%20Financial%20Services%20OpenSSF%20at%20OSFF.png --- [![FINOS](https://www.finos.org/hs-fs/hubfs/sofin%20assets/SOFIN%20LOGOS/finos-logo.png?width=543&height=126&name=finos-logo.png "FINOS")](https://finos.org) - [Projects](https://www.finos.org/projects) - [Artificial Intelligence (AI)](https://ai.finos.org/) - [Common Domain Model (CDM)](https://www.finos.org/common-domain-model) - [FDC3](https://www.finos.org/fdc3) - [Fluxnova](https://fluxnova.finos.org) - [FINOS Common Cloud Controls](https://www.finos.org/common-cloud-controls-project) - [High Performance Computing (HPC)](https://hpc.finos.org) - [OSERA](https://osera.finos.org/) - [Open Source Readiness Initiative](https://www.finos.org/open-source-readiness) - [OS-Climate](https://www.finos.org/os-climate) - [Try our Projects](https://www.finos.org/project-sandbox) - [All Projects Landscape](https://landscape.finos.org/) - [Community](https://www.finos.org/engage-with-our-community) - [FINOS Community Calendar](https://www.finos.org/calendar) - [Community Quickstart](https://www.finos.org/get-involved) - [FINOS Community Site](https://community.finos.org/) - [Contribute](https://community.finos.org/docs/governance/Software-Projects/contribution) - [Unable to Contribute?](https://www.finos.org/open-source-readiness) - [Join our Slack channel](https://finos-lf.slack.com/messages/finos-community/) - [Recognize a contributor](https://github.com/finos/community/issues/new?assignees=mcleo-d&labels=community-recognition&template=Community-Recognition.md&title=FINOS+Community+Recognition) - [Ambassador Program](https://www.finos.org/ambassador-program) - [Membership](https://www.finos.org/membership-benefits) - [Members](https://www.finos.org/members) - [Inquire](https://www.finos.org/membership-benefits#become-a-member) - [Join](https://joinnow.platform.linuxfoundation.org/?project=finos) - [Member ROI Summary & Calculator](https://www.finos.org/roi-report-calculator) - [Dependency Consumption Analysis](https://www.finos.org/dependency-consumption-analysis) - Resources - [2025 Mission & Vision](https://www.finos.org/2024-in-review-2025-vision) - [Research & Case Studies](https://www.finos.org/research-case-studies) - [Training](https://training.linuxfoundation.org/finos/) - [Open Source Maturity Model](https://osr.finos.org/docs/bok/OSMM/Introduction) - [Contributions Live Dashboard](https://metrics.finos.org) - [Our Github Organization](https://github.com/finos/) - [Our Developer Toolchain](https://odp.finos.org/) - [FINOS Store](https://store-finos.myshopify.com/) - News & Events - [This Week At FINOS](https://www.finos.org/this-week-at-finos) - [Community Blog](https://www.finos.org/blog) - [Newsletter](https://www.finos.org/newsletter) - [Podcast: Open Source in Finance](https://www.finos.org/open-source-in-finance-podcast) - [Press Releases](https://www.finos.org/press) - [FINOS Events](https://www.finos.org/hosted-events) - [Community Events](https://www.finos.org/featured-events) - [Community Spotlight](https://www.finos.org/community-spotlight) - [Stay Informed](https://www.finos.org/sign-up) - [About](https://www.finos.org/about-us) - [Stay Informed](https://www.finos.org/sign-up) - [FAQs](https://www.finos.org/faq) - [Contact Us](https://www.finos.org/contact-us) - [Governing Board](https://www.finos.org/governing-board) - [Technical Oversight Committee](https://www.finos.org/technical-oversight-committee) - [Team](https://www.finos.org/team) - [Governance](https://www.finos.org/governance) - [Code of Conduct](https://www.finos.org/code-of-conduct) - [OSFF + Videos](https://events.linuxfoundation.org/open-source-finance-forum) - [OSFF 2026](https://events.linuxfoundation.org/open-source-finance-forum/) - [OSFF NY Workshops](https://www.finos.org/osff-ny-2026-workshops) - [OSFF Toronto 2026 Videos](https://www.finos.org/osff-toronto-2026-videos) - [OSFF New York 2025 Videos](https://www.finos.org/osff-nyc-2025-videos) - [OSFF London 2026 Videos](https://www.finos.org/osff-london-2026-videos) - [apidays Paris 2025 Videos](https://www.finos.org/apidays) - [Projects](https://www.finos.org/projects) - [Artificial Intelligence (AI)](https://ai.finos.org/) - [Common Domain Model (CDM)](https://www.finos.org/common-domain-model) - [FDC3](https://www.finos.org/fdc3) - [Fluxnova](https://fluxnova.finos.org) - [FINOS Common Cloud Controls](https://www.finos.org/common-cloud-controls-project) - [High Performance Computing (HPC)](https://hpc.finos.org) - [OSERA](https://osera.finos.org/) - [Open Source Readiness Initiative](https://www.finos.org/open-source-readiness) - [OS-Climate](https://www.finos.org/os-climate) - [Try our Projects](https://www.finos.org/project-sandbox) - [All Projects Landscape](https://landscape.finos.org/) - [Community](https://www.finos.org/engage-with-our-community) - [FINOS Community Calendar](https://www.finos.org/calendar) - [Community Quickstart](https://www.finos.org/get-involved) - [FINOS Community Site](https://community.finos.org/) - [Contribute](https://community.finos.org/docs/governance/Software-Projects/contribution) - [Unable to Contribute?](https://www.finos.org/open-source-readiness) - [Join our Slack channel](https://finos-lf.slack.com/messages/finos-community/) - [Recognize a contributor](https://github.com/finos/community/issues/new?assignees=mcleo-d&labels=community-recognition&template=Community-Recognition.md&title=FINOS+Community+Recognition) - [Ambassador Program](https://www.finos.org/ambassador-program) - [Membership](https://www.finos.org/membership-benefits) - [Members](https://www.finos.org/members) - [Inquire](https://www.finos.org/membership-benefits#become-a-member) - [Join](https://joinnow.platform.linuxfoundation.org/?project=finos) - [Member ROI Summary & Calculator](https://www.finos.org/roi-report-calculator) - [Dependency Consumption Analysis](https://www.finos.org/dependency-consumption-analysis) - Resources - [2025 Mission & Vision](https://www.finos.org/2024-in-review-2025-vision) - [Research & Case Studies](https://www.finos.org/research-case-studies) - [Training](https://training.linuxfoundation.org/finos/) - [Open Source Maturity Model](https://osr.finos.org/docs/bok/OSMM/Introduction) - [Contributions Live Dashboard](https://metrics.finos.org) - [Our Github Organization](https://github.com/finos/) - [Our Developer Toolchain](https://odp.finos.org/) - [FINOS Store](https://store-finos.myshopify.com/) - News & Events - [This Week At FINOS](https://www.finos.org/this-week-at-finos) - [Community Blog](https://www.finos.org/blog) - [Newsletter](https://www.finos.org/newsletter) - [Podcast: Open Source in Finance](https://www.finos.org/open-source-in-finance-podcast) - [Press Releases](https://www.finos.org/press) - [FINOS Events](https://www.finos.org/hosted-events) - [Community Events](https://www.finos.org/featured-events) - [Community Spotlight](https://www.finos.org/community-spotlight) - [Stay Informed](https://www.finos.org/sign-up) - [About](https://www.finos.org/about-us) - [Stay Informed](https://www.finos.org/sign-up) - [FAQs](https://www.finos.org/faq) - [Contact Us](https://www.finos.org/contact-us) - [Governing Board](https://www.finos.org/governing-board) - [Technical Oversight Committee](https://www.finos.org/technical-oversight-committee) - [Team](https://www.finos.org/team) - [Governance](https://www.finos.org/governance) - [Code of Conduct](https://www.finos.org/code-of-conduct) - [OSFF + Videos](https://events.linuxfoundation.org/open-source-finance-forum) - [OSFF 2026](https://events.linuxfoundation.org/open-source-finance-forum/) - [OSFF NY Workshops](https://www.finos.org/osff-ny-2026-workshops) - [OSFF Toronto 2026 Videos](https://www.finos.org/osff-toronto-2026-videos) - [OSFF New York 2025 Videos](https://www.finos.org/osff-nyc-2025-videos) - [OSFF London 2026 Videos](https://www.finos.org/osff-london-2026-videos) - [apidays Paris 2025 Videos](https://www.finos.org/apidays) ![Community Blog](https://www.finos.org/hubfs/10.04.19.FINOS_WebsiteBanners_3.png) # Community Blog # Building Security in Open Source for Financial Services: OpenSSF at OSFF October 07, 2025 [Christopher “CRob” Robinson](https://www.finos.org/blog/author/christopher-crob-robinson) Financial services run on open source. With regulations growing and supply chains under pressure, institutions need clear frameworks and reliable data to keep systems secure. At the [Open Source in Finance Forum (OSFF)](https://events.linuxfoundation.org/open-source-finance-forum-new-york/?__hstc=14087400.b9bfc8cd749380f15f95c3d27fd7084b.1709572410603.1757457402571.1757510006095.343&__hssc=14087400.5.1757510006095&__hsfp=2815531451) the [OpenSSF](https://openssf.org/) community is sponsoring and sharing sessions on the OSPS Baseline, vulnerability data, and AI security. These talks demonstrate how our community is making open source more secure and useful to financial services.  ![2025-10-07 - Building Security in Open Source for Financial Services OpenSSF at OSFF](https://www.finos.org/hs-fs/hubfs/Community%20Blog/2025-10-07%20-%20Building%20Security%20in%20Open%20Source%20for%20Financial%20Services%20OpenSSF%20at%20OSFF.png?width=453&height=253&name=2025-10-07%20-%20Building%20Security%20in%20Open%20Source%20for%20Financial%20Services%20OpenSSF%20at%20OSFF.png)   ## **Why OpenSSF at OSFF** Open source is everywhere in financial services. A recent survey showed that 85 percent of firms in the sector are increasing their use of open source, with nearly 60 percent saying it is a significant increase ([FINOS](https://www.finos.org/blog/open-source-software-in-finance-trends-and-insights)). Teams choose it because it reduces costs, speeds delivery, and helps attract talent ([Linux Foundation](https://www.linuxfoundation.org/blog/the-2024-state-of-open-source-in-financial-services)). With more use comes more risk. Security, compliance, and resilience need to be part of the conversation. That is why OpenSSF is sponsoring OSFF. Our [members](https://openssf.org/about/members/) include leading financial institutions like Capital One, JP Morgan Chase, and Morgan Stanley, technology providers serving financial services, policymakers shaping regulation, and open source maintainers who build and support the software relied upon by these institutions. Bringing all of those voices together is how practical solutions get built.   ## **All About That Base\[line\]: Charting a Path for Secure Open Source Projects** The [**Open Source Project Security (OSPS) Baseline**](https://openssf.org/projects/osps-baseline/) is a set of practical security practices that align with standards like NIST and the [EU Cyber Resilience Act (CRA)](https://openssf.org/public-policy/eu-cyber-resilience-act/). It gives financial institutions a clear, auditable checklist they can use to reduce risk and support their compliance. At [OSFF](https://osffny2025.sched.com/event/28S3f/all-about-that-baseline-charting-a-path-for-secure-open-source-projects-michael-lieberman-kusari-stephen-augustus-bloomberg?iframe=yes&w=100%25&sidebar=yes&bg=no), Stephen Augustus (Bloomberg) and Michael Lieberman (Kusari) will show how the Baseline works with real examples and demos.   ## **Communications Very Erratic (CVE) – Stabilizing vulnerability data for downstream** In April 2025, MITRE [announced](https://www.bleepingcomputer.com/news/security/mitre-warns-that-funding-for-critical-cve-program-expires-today/) that funding for the CVE and CWE programs had been eliminated, putting NIST’s NVD program at risk as well. CISA stepped in to cover costs for nine months, but no updates or improvements have been made since. Enterprises, regulators, and maintainers are left without direction, and the downstream impact is real. My talk, “[**Communications Very Erratic (CVE) – Stabilizing vulnerability data for downstream**](https://osffny2025.sched.com/event/28S3m/building-security-in-open-source-for-financial-services-openssf-at-osff-christopher-crob-robinson-openssfthe-linux-foundation?iframe=no)”, will cover the history behind the problem and how the open source community is working to stabilize vulnerability metadata. The goal is to give developers and financial institutions consistent, high-quality information they can rely upon to manage risk and meet obligations.   ## **Securing the Future of Open Source AI: A Holistic Approach** AI adoption in financial services is accelerating. Jamie Thomas (IBM) will [present](https://osffny2025.sched.com/event/28S3c/securing-the-future-of-open-source-ai-a-holistic-approach-jamie-thomas-ibm?iframe=yes&w=100%25&sidebar=yes&bg=no) OpenSSF’s AI security roadmap. This talk will connect lessons from the history of open source security to today’s AI landscape and introduce a multi-pronged approach that includes research, tooling, policy, and education.   ## **Why Finance Leaders Should Pay Attention** - The [**OSPS Baseline**](https://openssf.org/projects/osps-baseline/) gives you a framework you can actually use. - The CVE session highlights how the community is working to restore stability to the data financial institutions need. - The **AI security roadmap** helps you adopt new technologies with confidence. - The [Cybersecurity Skills Framework](https://cybersecurityframework.io/) from OpenSSF and The Linux Foundation Education will give your teams the ability to deliver securely. ## **Join Us at OSFF** The OpenSSF community is proud to sponsor the Open Source in Finance Forum with FINOS. - [Register for OSFF](https://events.linuxfoundation.org/open-source-finance-forum-new-york/) - [Explore the OSPS Baseline](https://baseline.openssf.org/) - [Learn more at OpenSSF.org](https://openssf.org/) Our community is made up of good friends across industries who bring their knowledge and energy to solving these problems. Join us at OSFF to hear the talks, ask questions, and take part in strengthening open source security for financial services.   *Author: Christopher “CRob” Robinson, Chief Security Architect, OpenSSF* Christopher Robinson (aka CRob) is the Chief Security Architect for the Open Source Software Foundation (OpenSSF). With over 25 years of experience in engineering and leadership, he has worked with Fortune 500 companies in industries like finance, healthcare, and manufacturing, and spent six years as Program Architect for Red Hat’s Product Security team.     [**FINOS Good First Issues**](https://github.com/search?q=org%3Afinos+is%3Aopen+label%3A%22good+first+issue%22&unscoped_q=is%3Aopen+label%3A%22good+first+issue%22) - Looking for a place to contribute? Take a look at good first issues across FINOS projects and get your feet wet in the FINOS community. [State of Open Source in Financial Services Report 2024](https://www.finos.org/state-of-open-source-in-financial-services-2024) - Learn about what is really happening around open source in FSI. [**This Week at FINOS Blog**](https://finos.org/this-week-at-finos?utm_campaign=20210312%20Newsletter&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9Zgn2rjI2nlAwd4d3Mf5LKC8CmqUJ1wzZYFYOTKgWIuCxaowceMq1Y0ZiFrWPAcWoelavo) - See what is happening at FINOS each week. [**FINOS Landscape**](https://landscape.finos.org/?utm_campaign=20210312%20Newsletter&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9Zgn2rjI2nlAwd4d3Mf5LKC8CmqUJ1wzZYFYOTKgWIuCxaowceMq1Y0ZiFrWPAcWoelavo) - See our landscape of FINOS open source and open standard projects. [**Community Calendar**](https://calendar.finos.org)- Scroll through the calendar to find a meeting to join. [**FINOS Slack Channels**](https://finos.org/blog/finos-announces-new-community-slack?utm_campaign=20210428%20-%20FINOS%20All%20Community%20Call%20-%20Q2%202021&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9Zgn2rjI2nlAwd4d3Mf5LKC8CmqUJ1wzZYFYOTKgWIuCxaowceMq1Y0ZiFrWPAcWoelavo) - The FINOS Slack provides our Community another public channel to discuss work in FINOS and open source in finance more generally. [**Project Status Dashboard**](https://metrics.finos.org/goto/7bfcb03f027a1406c997d731d4715ea7?utm_campaign=20210312%20Newsletter&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9Zgn2rjI2nlAwd4d3Mf5LKC8CmqUJ1wzZYFYOTKgWIuCxaowceMq1Y0ZiFrWPAcWoelavo) - See a live snapshot of our community contributors and activity. [**Events**](https://finos.org/news-and-events?utm_campaign=20210312%20Newsletter&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-9Zgn2rjI2nlAwd4d3Mf5LKC8CmqUJ1wzZYFYOTKgWIuCxaowceMq1Y0ZiFrWPAcWoelavo) - Check out our upcoming events or email [**marketing@finos.org**](mailto:marketing@finos.org) if you'd like to partner with us or have an event idea. [**FINOS Open Source in Finance Podcasts**](https://anchor.fm/finos) - Listen and subscribe to the first open source in fintech and banking podcasts for deeper dives on our virtual "meetup" and other topics.   ### Share this: - [Tweet](https://twitter.com/share) [← FINOS Q3 2025 All Community Call](https://www.finos.org/blog/finos-q3-2025-all-community-call) [Building the Future of Open Source in Finance with FINOS →](https://www.finos.org/blog/building-the-future-of-open-source-in-finance-with-finos) [![FINOS Logo](https://www.finos.org/hs-fs/hubfs/sofin%20assets/SOFIN%20LOGOS/FINOS_Icon_Wordmark_White.png?width=689&height=971&name=FINOS_Icon_Wordmark_White.png "FINOS Logo")](https://www.finos.org/) [![Twitter logo](https://finos.org/hubfs/2419532/FINOS/website/logos/social-logos/twitter-blue-social-panel.png)](https://twitter.com/finosfoundation) [![GitHub logo](https://finos.org/hubfs/2419532/FINOS/website/logos/social-logos/github-black-social-panel.png)](https://finos.github.io) [![LinkedIn logo](https://finos.org/hubfs/2419532/FINOS/website/logos/social-logos/linkedin-blue-social-panel.png)](https://www.linkedin.com/company/finosfoundation) [![SlideShare logo](https://finos.org/hubfs/2419532/FINOS/website/logos/social-logos/Homepage%20Social%20Panel/slideshare-logo.png)](https://www.slideshare.net/finosfoundation) [![YouTube logo](https://finos.org/hubfs/2419532/FINOS/website/logos/social-logos/Homepage%20Social%20Panel/youtube_logo-1.png)](https://www.youtube.com/channel/UCfJAdRALzJ7J7snubrb_Y-Q) [Contact Us](https://www.finos.org/contact-us) [info@finos.org](mailto:info@finos.org) +1 (650) 665-9773 [Privacy |](https://www.finos.org/privacy-policy)[Terms of Service |](https://www.finos.org/terms-of-service)[Community Code of Conduct |](https://www.finos.org/code-of-conduct)[Email Preferences](https://www.finos.org/hs/manage-preferences/unsubscribe-simple)