Next Generation Software Supply Chain Security

Project Information

COANA

Grant agreement ID: 101202163

DOI

10.3030/101202163

EC signature date 16 May 2025

Start date 1 June 2025

End date 31 May 2027

Funded under

• The European Innovation Council (EIC)

Total cost

No data

EU contribution

€ 2 496 249,98

Coordinated by

COANA APS
Denmark

Periodic Reporting for period 1 - COANA (Next Generation Software Supply Chain Security)

Reporting period: 2025-06-01 to 2026-05-31

Summary of the context and overall objectives of the project

Modern software is built on open source: 70–90% of the code in a typical application comes from third-party dependencies. This makes software supply chains a prime target - ENISA (European Union Agency for Cybersecurity) projects supply-chain attacks to be the foremost cybersecurity threat by 2030. Yet the tools meant to manage this risk, known as Software Composition Analysis (SCA), flood developers with alerts. Most of those alerts concern vulnerabilities in code that the application never actually runs, so genuine threats are buried in noise and security teams waste effort on issues that pose no real risk.
COANA addresses this directly. The project “Next Generation Software Supply Chain Security” develops “reachability-based” SCA: static program-analysis engines that examine a real-world codebase, trace how data flows through it, build a map of which functions can actually be called, and determine whether a known vulnerable function is genuinely reachable. Vulnerabilities that cannot be reached are filtered out, removing more than 80% of irrelevant alerts so developers focus only on what matters.
This 24-month EIC Transition action aims to mature the technology from laboratory validation toward operational readiness, expand it to more programming languages, and prove it in production with real enterprises. The wider goal is to strengthen the security of software supply chains, support compliance with EU rules such as NIS2 and the forthcoming Cyber Resilience Act.

Work performed from the beginning of the project to the end of the period covered by the report and main results achieved so far

In its first year the project extended the reachability technology to new programming languages and significantly improved its accuracy. Analysis for Python and Java was built, with Java reaching full function-level capability. Driven by concrete demand from enterprises, the engines were additionally extended to further ecosystems (.NET, Rust and PHP), beyond the languages originally planned.
The accuracy and scalability of the core JavaScript/TypeScript engine were enhanced through techniques such as selective context-sensitivity and improved modelling of standard libraries, keeping analysis fast even on very large codebases. The project’s curated vulnerability database was substantially expanded, enriching public vulnerability records with precise information on where vulnerable code lives and the conditions under which it can be exploited.The technology was integrated into the tools developers use every day, including project-tracking integrations and automated scanning across the major continuous-integration platforms, so analyses run automatically on every code change.
Crucially, the technology was validated in the field: multiple organisations across financial services, cloud infrastructure, media, the public sector and developer tools ran the analysis in their own environments. The headline result was confirmed repeatedly — the large majority of alerts were filtered out as unreachable, meeting or exceeding the 80% noise-reduction target. Over the period the project advanced from technology readiness level (TRL) 4 to TRL 5 and from business readiness level (BRL) 4 to BRL 5.

Progress beyond the state of the art and expected potential impact (including the socio-economic impact and the wider societal implications of the project so far)

The project advances sound, scalable call-graph and reachability analysis - building on and contributing back to peer-reviewed academic research - and is among the first to make this class of analysis practical across multiple languages on large, real-world enterprise applications. The combination of high recall, strong precision and acceptable analysis time at this scale goes beyond what conventional SCA tooling offers, where reachability is typically approximated coarsely or not at all.
The potential impact is both economic and societal. By cutting the volume of irrelevant alerts, the technology directly reduces the cost of vulnerability management for software-producing organisations and lets scarce security expertise focus on genuinely exploitable risk. Estimated savings run to hundreds of thousands of euros per year for a mid-sized engineering organisation and, scaled across the millions of developers in the EU, to billions of euros annually - while helping to address the large economic losses caused by software vulnerabilities each year.
To turn these results into sustained uptake, the main needs going forward are continued validation at production scale, broadening of language and ecosystem coverage in line with enterprise demand, and continued commercial exploitation. During the period the technology began reaching real enterprises through an established global software-security platform, providing a production-scale environment for validation and deployment that supported the project's progression in commercial readiness. Further work on detecting previously unknown vulnerabilities and malicious code, and on a clear regulatory and standards-compliance pathway, will reinforce both the technical lead and the route to market.