For over 15 years, as her career took her from erstwhile digital transformation platform provider Pivotal to the Cloud Foundry Foundation, to configuration management specialist Puppet and now ActiveState, the “through line” has been open source, says Abby Kearns.
Kearns joined ActiveState as CEO back in March 2026. Her arrival at the Vancouver, Canada-headquartered company coincided with a pivotal – no pun intended – moment in the history of open source software, the advent and impact of artificial intelligence (AI) and snappily named trends such as “vibe coding”.
“Open source is important to me – personally I think it’s important to everyone – because it’s in literally everything we do,” she says.
“The opportunity to come back to open source at a time when [it] is really having a bit of an existential crisis really resonated with me, and the ability to help organisations continue to write great software, even if it’s AI co-generated, but do so securely, was too good to pass up.”
ActiveState has been around since the late 1990s, but has flown under the radar until comparatively recently, says Kearns.
“ActiveState really started its journey helping companies figure out how to manage end-of-life languages,” she says. “A lot of the early stuff was around Perl and Tcl. Even 30 years ago, Perl was still not actively maintained, but organisations found it to be a critical part of their infrastructure and needed a company to help them keep up to date and manage it. That’s where ActiveState began.”
These days, the company claims to support more than 40 million open source libraries through its Curated Catalog service, which serves as a trusted source of well-maintained, secure open source libraries for customer developer teams to draw on.
‘Some random person in Nebraska’
It may not have been thought about much in the past, but the ability for organisations to have trust in open source libraries has always been incredibly important, and it is now becoming urgently so.
As any cyber pro with an interest in this field will tell you, it turns out that open source libraries are ripe for exploitation by threat actors for the same reason that they are so popular with developers; they are ultimately not controlled by any one organisation, but open to all, and as the famous XKCD webcomic aptly and succinctly puts it, often thanklessly maintained for decades by “some random person in Nebraska” who may not always have the capacity to monitor every change being made, or to withstand a social engineering attempt. “It’s a good joke, but it’s a joke because it’s true,” says Kearns.
Furthermore, as we are now seeing, AI is rapidly heightening these risks.
Indeed, not long after Kearns’ conversation with Computer Weekly, AI models run by OpenAI attempted to conduct multiple supply chain attacks of its own by interfering with open source libraries. In one instance, the Mythos agent involved tried to set up fake email accounts to commit a malicious package to its target project. In another test run by the UK’s AI Security Institute (AISI), it tried its hand at real-world social engineering.
But less dramatically, and more frequently, these issues arise because developers no longer just pull packages, they leverage AI assistants as part of their development workflows, and out of their “innate” need to appear helpful, the AI bots pull anything they can to get the job done, without caring if it’s a manipulated package update.
How did we get to this point? Kearns reckons a big change in attitudes took place a little over a decade ago, at about the time the first commit of Kubernetes was published to GitHub. She credits the subsequent explosion in cloud-native services with making organisations more comfortable with consuming open source packages straight from the tap, with no intermediate software provider involved.
Security an afterthought during the gold rush
Unfortunately, security – as is all too often the case – was something of an afterthought during this gold rush. “It’s a shortcut we were all happy to live with,” reflects Kearns.
All of which is to say nobody really had time for their hard-working developer teams to pay attention to security; nothing bad seemed to be happening, so developers were happy to pull from useful libraries and security teams were happy to let them. And at the time, that wasn’t necessarily a bad decision.
“By-and-large, open source is usually better, it’s usually more secure, there are usually more eyes on it,” says Kearns. “It is the right choice.
“But now, it’s become an increasingly prevalent way to attack the software supply chain. Open source is a great central point if you want to have a lot of impact quickly, and [as such] it’s become an attack vector for people with malicious intent that are trying to inject malware more easily across a broader number of victims.”
As a result of these converging trends, says Kearns, she sometimes likes to think that ActiveState’s founders may have been well ahead of their time in some ways.
“All of a sudden, the market is rising to meet us – data is coming in daily now that [shows] this is really the time to think about securing open source,” she says. “Open source software is in 98% of all things developed today, and so is the underpinning of everything.
“I’m hoping people are standing up and paying attention now, with just the pure number of attacks on the software supply chain that we’ve seen, and the rampant increase of those, and the implications of those increases,” she says. “It’s blowing my mind on a daily basis.”
“I’m hoping people are standing up and paying attention now, with just the pure number of attacks on the software supply chain that we’ve seen, and the rampant increase of those, and the implications of those increases. It’s blowing my mind on a daily basis”
Abby Kearns, ActiveState
Asked what cyber security leaders and developers need to do to get ahead of this problem, Kearns says there is no real checklist, per se, beyond what has already been written a thousand times in the IT trade media – be aware of what’s coming into your environment.
“I don’t necessarily want to say you have to go super deep on your SBOMs [software bills of material], but if you are aware of the open source that you’ve used and the packages that you’ve pulled in, then you have the opportunity to apply governance more rigorously,” she says.
“At a high level, that’s what we tell our customers, and that was the whole purpose behind us building Curated Catalog, to give customers a repository of dependencies they can pull from that are known secure,” adds Kearns.
For a developer backed by such a product, her pitch is that nothing should fundamentally change.
“They pull the code, it goes into their existing repo of choice, they pull it into their existing CI/CD [continuous integration and continuous delivery] pipeline – it’s no different from their standpoint,” says Kearns. “It basically enables them to say, ‘here’s a repo where we’ve placed the languages in the libraries you need, but they’re known secure, so we can minimise our risk from upstream attacks’.”
Changing the conversation
Ultimately, Kearns says she wants to alter the thrust of the narrative around open source security, moving from one that centres SBOMs and compliance to one that centres a more proactive approach to the problem.
“This is less about compliance adherence and more about what is really going to help you mitigate and manage risk in your organisation, because there is zero way to apply enough humans to this to navigate this – it’s moving much too fast,” she says.
“We all do compliance because we have to, but nobody goes, ‘yay, compliance makes me safer’. We really want to tell people that ‘this is important, and here’s why’. Now is the time to have a really meaningful dialogue about it.”
