Next Generation Software Supply Chain Security

Informations projet

COANA

N° de convention de subvention: 101202163

DOI

10.3030/101202163

Date de signature de la CE 16 Mai 2025

Date de début 1 Juin 2025

Date de fin 31 Mai 2027

Financé au titre de

• The European Innovation Council (EIC)

Coût total

Aucune donnée

Contribution de l’UE

€ 2 496 249,98

Coordonné par

COANA APS
Denmark

Periodic Reporting for period 1 - COANA (Next Generation Software Supply Chain Security)

Période du rapport: 2025-06-01 au 2026-05-31

Résumé du contexte et des objectifs généraux du projet

Modern software is built on open source: 70–90% of the code in a typical application comes from third-party dependencies. This makes software supply chains a prime target - ENISA (European Union Agency for Cybersecurity) projects supply-chain attacks to be the foremost cybersecurity threat by 2030. Yet the tools meant to manage this risk, known as Software Composition Analysis (SCA), flood developers with alerts. Most of those alerts concern vulnerabilities in code that the application never actually runs, so genuine threats are buried in noise and security teams waste effort on issues that pose no real risk.
COANA addresses this directly. The project “Next Generation Software Supply Chain Security” develops “reachability-based” SCA: static program-analysis engines that examine a real-world codebase, trace how data flows through it, build a map of which functions can actually be called, and determine whether a known vulnerable function is genuinely reachable. Vulnerabilities that cannot be reached are filtered out, removing more than 80% of irrelevant alerts so developers focus only on what matters.
This 24-month EIC Transition action aims to mature the technology from laboratory validation toward operational readiness, expand it to more programming languages, and prove it in production with real enterprises. The wider goal is to strengthen the security of software supply chains, support compliance with EU rules such as NIS2 and the forthcoming Cyber Resilience Act.

Travail effectué depuis le début du projet jusqu’à la fin de la période considérée dans le rapport et principaux résultats atteints jusqu’à présent

In its first year the project extended the reachability technology to new programming languages and significantly improved its accuracy. Analysis for Python and Java was built, with Java reaching full function-level capability. Driven by concrete demand from enterprises, the engines were additionally extended to further ecosystems (.NET, Rust and PHP), beyond the languages originally planned.
The accuracy and scalability of the core JavaScript/TypeScript engine were enhanced through techniques such as selective context-sensitivity and improved modelling of standard libraries, keeping analysis fast even on very large codebases. The project’s curated vulnerability database was substantially expanded, enriching public vulnerability records with precise information on where vulnerable code lives and the conditions under which it can be exploited.The technology was integrated into the tools developers use every day, including project-tracking integrations and automated scanning across the major continuous-integration platforms, so analyses run automatically on every code change.
Crucially, the technology was validated in the field: multiple organisations across financial services, cloud infrastructure, media, the public sector and developer tools ran the analysis in their own environments. The headline result was confirmed repeatedly — the large majority of alerts were filtered out as unreachable, meeting or exceeding the 80% noise-reduction target. Over the period the project advanced from technology readiness level (TRL) 4 to TRL 5 and from business readiness level (BRL) 4 to BRL 5.

Progrès au-delà de l’état des connaissances et impact potentiel prévu (y compris l’impact socio-économique et les conséquences sociétales plus larges du projet jusqu’à présent)

The project advances sound, scalable call-graph and reachability analysis - building on and contributing back to peer-reviewed academic research - and is among the first to make this class of analysis practical across multiple languages on large, real-world enterprise applications. The combination of high recall, strong precision and acceptable analysis time at this scale goes beyond what conventional SCA tooling offers, where reachability is typically approximated coarsely or not at all.
The potential impact is both economic and societal. By cutting the volume of irrelevant alerts, the technology directly reduces the cost of vulnerability management for software-producing organisations and lets scarce security expertise focus on genuinely exploitable risk. Estimated savings run to hundreds of thousands of euros per year for a mid-sized engineering organisation and, scaled across the millions of developers in the EU, to billions of euros annually - while helping to address the large economic losses caused by software vulnerabilities each year.
To turn these results into sustained uptake, the main needs going forward are continued validation at production scale, broadening of language and ecosystem coverage in line with enterprise demand, and continued commercial exploitation. During the period the technology began reaching real enterprises through an established global software-security platform, providing a production-scale environment for validation and deployment that supported the project's progression in commercial readiness. Further work on detecting previously unknown vulnerabilities and malicious code, and on a clear regulatory and standards-compliance pathway, will reinforce both the technical lead and the route to market.