Video by FINOS via YouTube
Dov Katz (Managing Director at Morgan Stanley) presents a deep-dive walkthrough of the Risk Navigator tool built for the OSERA (Open Source Enterprise Resiliency Alliance) initiative. He demonstrates how platform engineering and security teams can parse complex Software Bills of Materials (SBOMs), prioritize back-patching requirements across thousands of repositories, and use automated OpenRewrite pipelines to burn down transitive CVE vulnerabilities at enterprise scale.
🗽 Catch Us in New York! Ready to secure your software supply chain and scale automated patch management? Join the enterprise security community at OSFF New York on November 4–5, 2026.
🎟️ Register Now: https://hubs.ly/Q04n_bZL0
🔥 20% OFF DISCOUNT CODE: 26YTOSFFNY20C
🕒 Timestamps:
0:00 Unconference Kickoff: Why Banks Are Commissioning Shared Back-Patches
1:00 Navigating Shared Infrastructure Priorities and Commissioned Capacity
1:39 Introducing Risk Navigator: Mapping Enterprise Dependency Data Sets
2:30 Quantifying Productivity: Using Reduced CVE/CWE Counts over Merged PRs
3:35 Navigating Transitive Dependencies: High-Leverage Upgrades vs. Developer Friction
4:20 Spec-Driven Local Deployments: Tailoring Risk Navigator for Corporate Estates
5:30 Dashboard Walkthrough: Filtering Patch-Level Opportunities and Version Offsets
6:10 Setting CVSS Vulnerability Thresholds and Evaluating Active Exploits
7:20 Identifying "Dead Ends": When Software Requires Commissioned Back-Patching
8:00 The Version-Bumping Shopping Cart: Generating OpenRewrite YAML Automations
8:41 Back-Patch Priority Matrices: Mutualizing Morgan Stanley, Citi, and Deutsche Bank Lists 9:30 Targeting Amplifiers: Base Container Images and Transitive Spring Framework CVEs
10:00 Privacy and Execution: Running Static JSON Data Pipelines Privately Behind Firewalls
10:40 Transitioning to Scale: Remediation Workflows with Moderne
📊 The Problem: The Transitive Dependency Patching Nightmare
When security scanners flag tens of thousands of Common Vulnerabilities and Exposures (CVEs) across an enterprise codebase containing 60,000 source repositories, platform teams face paralysis. Sending thousands of individual developers to manually add transitive overrides creates massive technical debt that becomes impossible to unwind when official patches release. Furthermore, many critical enterprise dependencies hit "dead ends"—where upstream maintainers have stopped supporting legacy versions—leaving banks with high-risk vulnerabilities and no clear upgrade path.
🏗️ The Solution: Risk Navigator & OpenRewrite Mutualization
Dov Katz demonstrates how financial institutions can use Spec-Driven decision support tools to prioritize remediation:
High-Leverage Amplifiers: Locating core framework and base container image dependencies (such as Spring or base Linux RPMs) where a single patch closes thousands of downstream vulnerability touchpoints simultaneously.
Dead-End Identification: Distinguishing between software that can be immediately bumped to minor/patch versions versus legacy packages requiring joint industry-commissioned back-patching.
Automated Shopping Carts: Selecting vetted dependency targets and exporting OpenRewrite YAML scripts to automatically execute version updates across thousands of repositories.
⚙️ Why This Matters for Financial Engineering
Quantifying True Security ROI: Shifting engineering metrics away from vanity signals (like merged PR counts) to measurable security burn-down rates (reducing active CVE touchpoints from 500,000 to 100,000).
Local Data Privacy: Running static, spec-driven analysis engines completely offline inside corporate environments without sending internal dependency trees or proprietary code to external APIs.
🌐 More about FINOS: https://www.finos.org/
📧 Join our newsletter: https://www.finos.org/sign-up
🎙️ Listen to our Open Source in Finance Podcast: https://www.youtube.com/@FINOS/podcasts
LinkedIn: https://www.linkedin.com/company/finosfoundation
#FINOS #OSFFNewYork #OSERA #MorganStanley #RiskNavigator #SupplyChainSecurity #DevSecOps #OpenRewrite #CVE #PatchManagement