FOSSA

“Reporting is one of the core functionalities that we’ve used from FOSSA,” Valentina says. “We issue reports for customers, partners, investors, or whatever stakeholders ask during due diligence exercises. We issue reports, and we trust them.”

“FOSSA has always been extremely responsive in adding new licenses,” Valentina says. “The fact that they cover license types beyond open source is also a great benefit. As a company that uses a lot of .NET, we’ve particularly appreciated having coverage of freeware and shareware licenses.”

“FOSSA enables engineering to see the path of a certain dependency,” Valentina says. “They know where to go to really understand that dependency’s use case, which helps us understand if that dependency can be removed, or if it should be updated, and so on.”

“FOSSA is well integrated within our build and CI/CD pipelines,” Valentina says. “Engineering can see when licenses are flagged, and they come to me or to our legal team for further review if there’s an issue that requires it.”

“FOSSA is the only tool that we use in UiPath for license management, and I think that says a lot,” Valentina says. “We’ve tested others, but FOSSA keeps delivering.”

“FOSSA is a really good blend of licensing and security,” Valentina says. “Typically, you see vendors do one or the other better. FOSSA does both of them quite well. FOSSA has been great at helping us stay ahead as there’s been a shift toward automation, efficiency, and better vulnerability prioritization.”

“"We couldn't do what we do now without FOSSA."”

““I tell everyone inside Milliman who will listen that they need FOSSA. My message is: Run, don’t walk, to adopt and implement it.””

““FOSSA is fully integrated into our daily code development process,” Hoffman says. “And it’s an important part of our overall risk management practices.””

““We also inform our clients about our processes and reports and can point to our SOC 2 certification, which FOSSA has a role in enabling.””

““We occasionally have to address customer concerns about some vulnerability that shows up in the news overnight,” Hoffman says. “We can quickly reference our bill of materials and show we are not affected.””

““We use FOSSA to generate a comprehensive PDF report with all our required notices,” Charles says. “We package the report and ship it with our products.””

““FOSSA helps everyone collaborate on these items. For example, our project manager has excellent visibility into any potential vulnerabilities and their severity, and she can ensure they get into the right sprint for us to address them.””

““Every time we check in code, FOSSA scans it,” Erickson says. “Mostly, it works in the background; we’re only notified when there’s an issue. We can easily act on those notices and bring them to the larger team.””

““Integration was straightforward,” says Paul Erickson. “We easily integrated FOSSA with Azure DevOps and our GitHub. I was thrilled with how quickly we could get full coverage from FOSSA across all our platforms.””

““We chose FOSSA because it provided everything we needed, all the core functionality: code scanning, license compliance, and vulnerability management,” Hoffman says. “And its cost was reasonable for all the value it provided us.””

““It’s a night and day difference now that we use FOSSA. FOSSA has been a huge time-saver.””

““We can also generate a comprehensive software bill of materials, which is a huge benefit; we can click a few buttons and generate a report we can package with our release.””

““We now know all of the open source components and licenses we use, including transitive dependencies,” says Charles Hoffman, Milliman’s Principal and Director of Software Development. “If there’s a new, high-severity vulnerability and our CISO sends an all-hands-on-deck email asking if we’re affected, we can tell them unequivocally in seconds. We’re able to identify and resolve vulnerabilities quickly.”

“FOSSA made it easy for us to navigate a complex due diligence process, and it’s given us peace of mind that we have control over our open source,” Busby says. “We’re comfortable relying on this tool to help us with license compliance, security, SBOMs, and audits moving forward.”

“FOSSA helps us find when packages get old and haven't been updated in a timely fashion,” Shinners says. “We can then ping the right people and let them know we need to update to a newer version. It does a lot to help mitigate our potential exposure because we're taking a proactive approach.”

“Our developers realized that we were watching out for their back side in the compliance process,” Busby says. “And, as a result, we now have people asking us questions in advance of trying to shove something into the build pipe. It has raised awareness among our software staff to have somebody take a look before you jump, and that I think is of immense value.”

“FOSSA has a good database of open source licenses and the scanning engine to detect them while meeting our security concerns about keeping our code base secure. It also has a vulnerability database and a skilled support team willing to work with our build team,”

“But with FOSSA, it was seamless. It was fast. It was efficient. It was easy to get set up; we got the tool integrated into our build pipeline, with really no disruption ever. And the user interface is really nice, so the scan results are easy to understand.”

““We monitor the FOSSA dashboards and take care of any issues, including security and license compliance, that are identified,” Girish said.”