Key Takeaways

• Building this in-house is a standing, multi-domain security engineering commitment, rather than a project with an end date.
• AI writes scaffolding faster but, per independent research, ships more security findings while it does it.
• Hand AI the operation, including the code, and you inherit a specific list of new failure modes: hallucinated packages, excessive agent permissions, and prompt injection.
• A back of envelope model using U.S. Bureau of Labor Statistics wages puts the minimum viable team north of $250,000 a year in salary alone, before the months it takes to cover a single production dependency tree.
• ActiveState's Curated Catalog delivers this already built: components across 12 language ecosystems, remediated against contractual SLAs.

The Question Every VP of Engineering Eventually Asks

Ninety-eight percent (98%) of applications now run on open source software, according to the 2026 Open Source Security and Risk Analysis Report. Most of it, your team did not choose deliberately. It arrived as a transitive dependency of a transitive dependency, or because an AI coding assistant suggested it and a developer accepted the suggestion in a single keystroke.

At some point, someone on your team asks the obvious question. Why pay a vendor for this when you could build it yourselves? Fair question. The answer is more complicated than most roadmap discussions give it credit for.

What "Build It Ourselves" Actually Requires

A vetting and remediation pipeline is a standing capability that cuts across four separate engineering domains. OpenSSF's Principles for Package Repository Security lays out the surface area before you even get to remediation: authentication and account security for anyone publishing into the system, authorization controls like scoped API keys and short-lived tokens, vulnerability disclosure policies and malware scanning, and tooling for dependency pinning, SBOM generation, and install-time warnings.

That is the repository layer alone. On top is the part your security team actually cares about: building components from source instead of trusting whatever binary a public registry hands back, triaging every new CVE against your dependency tree, assigning an owner, and doing it all on a timeline you can defend to an auditor. 

Using AI As A Shortcut Gives The Same Risk, Applied Faster

The instinct to speed this up with AI makes sense. 84% of developers use AI or plan to, according to Stack Overflow's 2025 Developer Survey of more than 49,000 respondents. If AI can write the pipeline faster, building a solution can start to look attractive.

The problem is that the same AI-assisted development that speeds up your build also produces the exact category of risk this pipeline exists to catch. Apiiro's research on AI-assisted repositories, drawn from tens of thousands of repositories at Fortune 50 companies, found AI-generated code introduced more than 10,000 new security findings per month as of June 2025. A tenfold increase from December 2024. Privilege escalation paths up 322%. Architectural design flaws up 153%. A separate analysis from CodeRabbit found AI-authored pull requests produced 75% more logic and correctness issues and up to 2.74 times more security findings than human-authored ones.

Building your vetting pipeline faster with AI that raises the defect rate, is the risk you are trying to govern, applied to the governance system itself.

Every Workstream You Are Actually Signing Up For

"Build it ourselves" sounds like one project, but in conversations with organizations that we work with, it’s at least six standing workstreams, running in parallel:

• Registry ingestion.
  
  • Task: Mirror every package registry your teams actually pull from, for every language ecosystem in use, growing to those added after the pilot is scoped.
  • AI Potential Hazard: Hand the ingestion decision to an agent and you inherit its blind spot. Open source large language models hallucinate non-existent package names at rates up to 21.7%, and newer frontier commercial models test around 5%-6%. Attackers register those exact names so they land straight in your registry; a technique known as slopsquatting.
• Build-from-source infrastructure.
  
  • Task: Reproducibly build each component in isolation. Do not trust whatever binary a public registry hands back.
  • AI Potential Hazard: An autonomous agent doing this needs standing repository write access, credentials, and CI/CD control, precisely what OWASP's AI Agent Security guidance calls excessive autonomy and tool abuse. One compromised or manipulated agent can push what it builds to every downstream consumer.
• Scanning at ingestion.
  
  • Task: Check for vulnerabilities and malware before a package reaches a developer or an AI coding assistant. 
  • AI Potential Hazard: The Cloud Security Alliance have documented an incident, nicknamed "Clinejection," where a single malicious GitHub issue title triggered a prompt injection chain that stole credentials and pushed a malicious package to production for roughly 8 hours.
• SBOM and provenance generation.
  
  • Task: Produce an attestation for every build, in a format your compliance team can hand an auditors for regulations like FedRAMP and EU CRA on demand. 
  • AI Potential Hazard: An SBOM is only worth something if it survives an audit. A hallucinated dependency version or attestation detail turns a due diligence asset into a liability the moment a regulator checks it.
• CVE triage and ownership.
  
  • Task: Assign a named owner and a deadline to every new CVE the moment an upstream fix exists. Track it until it closes.
  • AI Potential Hazard: This is an accountability function. Someone has to own it, indefinitely. Under the EU CRA and SEC disclosure rules, an agent can flag and prioritize a CVE, but it cannot be the name on the SLA.
• Ongoing maintenance.
  
  • Task: Keep all of it running against upstream churn. New CVEs, new packages, new maintainer keys, new registry policies, for as long as the organization ships software.
  • AI Potential Hazard: An agent with indefinite, standing access to all of it is a persistent high-value target, and OWASP separately warns that cascading failures and runaway cost both get worse the longer an agent runs unattended.

These do not happen in sequence. A critical CVE can land in a dependency your team shipped 3 years ago, while the scanning workstream for last quarter's new language ecosystem is still being built. The complexity is running all six at once, indefinitely. Handing that operation to an autonomous agent to save headcount hands standing, high-privilege access to the exact systems this pipeline exists to protect, to a class of tool with a documented, real-world track record of being manipulated through the untrusted content it was built to process.

What This Costs, Realistically

Assume a minimum viable team: one senior security engineer to own triage, remediation, and audit readiness, and one build or platform engineer to own source builds, repository infrastructure, and SBOM tooling. At the U.S. Bureau of Labor Statistics' May 2024 median annual wages, an information security analyst earns $124,910 and a software developer earns $133,080. Combined, $257,990 a year in salary alone. Before benefits, cloud infrastructure, build compute, or the tooling licenses this same team will still need to buy.

That figure assumes the smallest team that can plausibly cover the scope above, and that nothing goes wrong with retention, ramp time, or the maintainer relationships you need to track patches across every ecosystem your applications touch. Most organizations touch more than one ecosystem, which means the model needs to scale accordingly.

What You Get When You Buy It Instead

ActiveState's Curated Catalog builds every component from source inside SLSA Level 3 infrastructure and delivers it directly into the pipelines, package managers, and repositories your teams already use, including JFrog Artifactory. The library covers components across 12 language ecosystems. Every component is continuously remediated against contractual SLAs: 5 business days for critical CVEs, 10 for high, 30 for all others, with the clock starting once an upstream community fix is available.

For engineering leaders, the number that matters is the one your team gets back. 4 to 8 developer hours reclaimed per CVE, and a mean time to remediate cut by roughly 90% compared to teams running their own scanner and backlog process. Not 4 to 8 hours per incident. 4 to 8 hours per vulnerability, recurring, for every dependency your team did not have to triage themselves.

The paved road argument was never about whether your engineers can build this. They can. It is about whether their time is better spent building your product, or building and maintaining a security function that never ships a feature.

Run the Math on Your Own Roadmap

If your team is scoping this build internally, do it with real numbers. Your dependency tree, your language ecosystems, your actual headcount cost. Talk to ActiveState about running those numbers through our build vs. buy ROI calculator, and see what a fully governed catalog would save your team against the dependencies you are running today.

About the author: Rebecca Banks is Senior Product Marketing Manager at ActiveState, where she leads go-to-market strategy for software supply chain security. She is currently a contributor to the Linux Foundation and OpenSSF 2026 AI Security Study on global AI security maturity for enterprises and critical infrastructure organizations.