An Overview of Cyber Security Funding for Open Source Software
Jukka Ruohonen, Gaurav Choudhary, Adam Alami
TL;DR
This paper analyzes two OSS funding bodies, STA and OpenSSF, through a qualitative thematic analysis of funding cases to understand how cybersecurity and critical infrastructure concerns shape funding. It finds that OSS components such as supply chains, network libraries, OS-level components, and cryptography receive priority, with SBOM-focused work aligning with regulatory aims. The study argues that neither cybersecurity nor sustainability alone fully explain funding decisions, and it highlights the regulatory context of the Cyber Resilience Act as a relevant factor. It also suggests increased coordination among funding streams and potential inclusion of academic software engineering research to strengthen OSS security and resilience in practice.
Abstract
Context: Many open source software (OSS) projects need more human resources for maintenance, improvements, and sometimes even their survival. This need allegedly applies even to vital OSS projects that can be seen as being a part of the world's critical infrastructures. To address this resourcing problem, new funding instruments for OSS projects have been established in recent years. Objectives: The paper examines two such funding bodies for OSS and the projects they have funded. The focus of both funding bodies is on software security and cyber security in general. Methods: The methodology is based on qualitative thematic analysis. Results: Particularly OSS supply chains, network and cryptography libraries, programming languages, and operating systems and their low-level components have been funded and thus seen as critical in terms of cyber security by the two funding bodies. Conclusions: In addition to the qualitative results presented, the paper makes a contribution by connecting the research branches of critical infrastructure and sustainability of OSS projects. A further contribution is made by connecting the topic examined to recent cyber security regulations. Finally, an important argument is raised that neither cyber security nor sustainability alone can entirely explain the rationales behind the funding decisions made by the two bodies.