Next Generation Software Supply Chain Security

Projektinformationen

COANA

ID Finanzhilfevereinbarung: 101202163

DOI

10.3030/101202163

EK-Unterschriftsdatum 16 Mai 2025

Startdatum 1 Juni 2025

Enddatum 31 Mai 2027

Finanziert unter

• The European Innovation Council (EIC)

Gesamtkosten

Keine Daten

EU-Beitrag

€ 2 496 249,98

Koordiniert durch

COANA APS
Denmark

Periodic Reporting for period 1 - COANA (Next Generation Software Supply Chain Security)

Berichtszeitraum: 2025-06-01 bis 2026-05-31

Zusammenfassung vom Kontext und den Gesamtzielen des Projekts

Modern software is built on open source: 70–90% of the code in a typical application comes from third-party dependencies. This makes software supply chains a prime target - ENISA (European Union Agency for Cybersecurity) projects supply-chain attacks to be the foremost cybersecurity threat by 2030. Yet the tools meant to manage this risk, known as Software Composition Analysis (SCA), flood developers with alerts. Most of those alerts concern vulnerabilities in code that the application never actually runs, so genuine threats are buried in noise and security teams waste effort on issues that pose no real risk.
COANA addresses this directly. The project “Next Generation Software Supply Chain Security” develops “reachability-based” SCA: static program-analysis engines that examine a real-world codebase, trace how data flows through it, build a map of which functions can actually be called, and determine whether a known vulnerable function is genuinely reachable. Vulnerabilities that cannot be reached are filtered out, removing more than 80% of irrelevant alerts so developers focus only on what matters.
This 24-month EIC Transition action aims to mature the technology from laboratory validation toward operational readiness, expand it to more programming languages, and prove it in production with real enterprises. The wider goal is to strengthen the security of software supply chains, support compliance with EU rules such as NIS2 and the forthcoming Cyber Resilience Act.

Arbeit, die ab Beginn des Projekts bis zum Ende des durch den Bericht erfassten Berichtszeitraums geleistet wurde, und die wichtigsten bis dahin erzielten Ergebnisse

In its first year the project extended the reachability technology to new programming languages and significantly improved its accuracy. Analysis for Python and Java was built, with Java reaching full function-level capability. Driven by concrete demand from enterprises, the engines were additionally extended to further ecosystems (.NET, Rust and PHP), beyond the languages originally planned.
The accuracy and scalability of the core JavaScript/TypeScript engine were enhanced through techniques such as selective context-sensitivity and improved modelling of standard libraries, keeping analysis fast even on very large codebases. The project’s curated vulnerability database was substantially expanded, enriching public vulnerability records with precise information on where vulnerable code lives and the conditions under which it can be exploited.The technology was integrated into the tools developers use every day, including project-tracking integrations and automated scanning across the major continuous-integration platforms, so analyses run automatically on every code change.
Crucially, the technology was validated in the field: multiple organisations across financial services, cloud infrastructure, media, the public sector and developer tools ran the analysis in their own environments. The headline result was confirmed repeatedly — the large majority of alerts were filtered out as unreachable, meeting or exceeding the 80% noise-reduction target. Over the period the project advanced from technology readiness level (TRL) 4 to TRL 5 and from business readiness level (BRL) 4 to BRL 5.

Fortschritte, die über den aktuellen Stand der Technik hinausgehen und voraussichtliche potenzielle Auswirkungen (einschließlich der bis dato erzielten sozioökonomischen Auswirkungen und weiter gefassten gesellschaftlichen Auswirkungen des Projekts)

The project advances sound, scalable call-graph and reachability analysis - building on and contributing back to peer-reviewed academic research - and is among the first to make this class of analysis practical across multiple languages on large, real-world enterprise applications. The combination of high recall, strong precision and acceptable analysis time at this scale goes beyond what conventional SCA tooling offers, where reachability is typically approximated coarsely or not at all.
The potential impact is both economic and societal. By cutting the volume of irrelevant alerts, the technology directly reduces the cost of vulnerability management for software-producing organisations and lets scarce security expertise focus on genuinely exploitable risk. Estimated savings run to hundreds of thousands of euros per year for a mid-sized engineering organisation and, scaled across the millions of developers in the EU, to billions of euros annually - while helping to address the large economic losses caused by software vulnerabilities each year.
To turn these results into sustained uptake, the main needs going forward are continued validation at production scale, broadening of language and ecosystem coverage in line with enterprise demand, and continued commercial exploitation. During the period the technology began reaching real enterprises through an established global software-security platform, providing a production-scale environment for validation and deployment that supported the project's progression in commercial readiness. Further work on detecting previously unknown vulnerabilities and malicious code, and on a clear regulatory and standards-compliance pathway, will reinforce both the technical lead and the route to market.