Silent threats: The legal and cyber risk of abandoned open source code

Open source code is the backbone of modern software development, powering everything from small applications to critical infrastructure. But what happens when the maintainers walk away?

This presentation will explore the growing legal and cyber risk posed by abandoned open source components in the software supply chain. As organisations increasingly rely on open source libraries and frameworks, many fail to consider the implications of using code that is no longer actively maintained — creating an ideal target for exploitation by threat actors.

This presentation will examine real-world case studies of vulnerabilities in widely used open source libraries that went unnoticed or unpatched due to inactive development, and the ripple effects this can have across industries. We will explore legal duties and risk exposures for organisations that unknowingly incorporate such components, including liability risks, contractual obligations, and regulatory expectations around software assurance and third-party risk management.

Key topics will include:

The session is designed for cyber, risk and legal professionals who want to understand the hidden risks in their software stack, and for organisations looking to strengthen their governance of open source dependencies before they become liabilities.