JFrog Unveils Report Exposing Disconnects Between Senior Executives And Practitioners In AI/ML And Security Technologies; Highlights Gaps In Standardized Use And Increasing Risk Of Software Supply Cha

JFrog Ltd. (“JFrog”) (Nasdaq: FROG), the Liquid Software company and creators of the JFrog Software Supply Chain Platform, today unveiled the findings of a new report exposing disparities in MLOps and security perceptions between leadership and frontline teams that is increasing the risk of software supply chain (SSC) attacks around the globe.

Software supply chain security breaches are experiencing a significant uptick, according to a recent IDC survey showing a staggering 241% increase in such attacks year-over-year [1]. Surprisingly, only 30% of the survey respondents identified the need to address vulnerabilities in their software supply chain as a top security concern.

“The complexity of today’s software supply chain poses unprecedented risks. Despite leadership efforts to enable frontline teams with the right equipment, developers are struggling to improve efficiency and accelerate productivity due to tool sprawl, lengthy open source and ML model approvals, plus audit and compliance checks,” said Moran Ashkenazi, SVP & CISO, JFrog. “This discrepancy highlights the urgency for organizations to rethink their security strategies, focus more on AI/ML components, and align executives and doers on a mission to fortify their software supply chains.”

JFrog’s new report reveals several disparities between security executives and frontline software teams concerning malicious open-source package detection, AI/ML integration, and code-level security scans, including:

92% of executives claim their organizations possess tools to detect malicious open-source packages, while only 70% of developers agree with this statement.
Over 90% of executives believe they are using ML models in their software applications, but only 63% of developers confirm that is the case.
88% of executives believe AI/ML tools are being used for security scanning and remediation processes, however only 60% of DevSecOps teams report they are using these tools.
67% of executives believe code-level security scans are conducted regularly, while only 41% of developers confirm such is true.

JFrog’s study also delves into regional disparities in software supply chain security, visibility, and use of AI/ML technologies such as:

Awareness of Security Solutions: 14% of EMEA respondents were unaware of tools for identifying malicious open-source packages, in contrast to lower rates in the US (9%) and Asia (1%), highlighting a substantial disconnect in EMEA’s security strategies and operational understanding.
Adoption of AI/ML Models: Only 82% of EMEA respondents reported using AI/ML models, compared to 91% in the US and 99% in Asia. This variance may point to Europe’s risk-averse environment influenced by strict regulations, while we see faster adoption of AI/ML technologies in the US.

[1] IDC, “IDC Helps Organizations Navigate Software Supply Chain Security with New Industry-Leading Research,” 15 June 2023, https://www.idc.com/getdoc.jsp?containerId=prUS50913123

Related resources

[Featured Whitepaper]

Software Supply Chain State of the Union 2024

JFrog combined responses from 1,200 Security, Development, and Ops professionals, analysis from the JFrog Security Research team, and Artifactory data to understand the state of software supply chain security.

Download now

[Featured Whitepaper]

Total Economic Impact of the JFrog Software Supply Chain Platform

The JFrog Software Supply Chain Platform serves as a single system of record for automating the management of software updates at scale. It enables organizations to seamlessly build, secure, distribute, and deploy software with complete control over entire software releases, from code creation to device deployment.

Download now