EXANTE is urging enterprises to help fund the open source projects they depend on, warning that AI is accelerating cyber risks while critical software remains maintained by underfunded volunteers.
EXANTE is warning that the rapid adoption of artificial intelligence is exposing a growing sustainability crisis across the open source ecosystem, urging enterprises to treat open source software (OSS) as critical infrastructure rather than relying on volunteer maintainers.
The company said around 70% of modern software stacks depend on open source components, including databases, operating systems, cloud infrastructure, messaging systems and financial trading platforms. EXANTE added that roughly 70% of its own critical technology stack is open source.
According to the company, AI is accelerating both software development and cyberattacks, enabling threat actors to scan codebases, identify vulnerabilities and generate exploits much faster, leaving underfunded maintainers with shrinking windows to issue security patches.
“Stop calling it a hobby and start treating it as infrastructure, because that is what it is,” said Richard Forss, Chief Technology Officer at EXANTE.
EXANTE estimates open source contributes US$8.8 trillion in global economic value, yet nearly two-thirds of maintainers receive very limited financial support, even as hundreds of thousands of organisations rely on projects maintained by only a handful of volunteers.
To address the issue, the company launched the €1 million Gecko Fund, offering grants ranging from €10,000 to €150,000 for critical open source projects supporting trading and financial data systems. Its first recipient is Kryo, an open source data serialisation library maintained by just two developers without external funding.
“We believe the industry that benefits from these tools should play a role in sustaining them,” said Anatoly Knyazev, Founder of the Gecko Fund.
EXANTE also called on businesses to audit their open source supply chains and contribute funding, engineering expertise and security resources to strengthen the software they depend on.
