TrueSource is a new Broadcom software portfolio that provides enterprise support, security patches and verified software artifacts for organisations using open-source technologies.
Broadcom has introduced TrueSource, a new portfolio of services designed to help enterprises manage and secure open-source software. Announced at VMware Explore 2026, the offering focuses on verified and human-reviewed code rather than relying entirely on automated systems for security maintenance and vulnerability remediation.
The company’s approach comes as AI tools are increasingly being used for software development and security patching. Broadcom cited research indicating that only 26 per cent of 6,000 AI-generated patches successfully resolved vulnerabilities without introducing other application errors. TrueSource therefore combines automated scanning with human verification before security fixes are released.
The portfolio includes Spring Enterprise, which provides proactive security scanning across the Spring ecosystem and its dependency tree. Broadcom engineers use models to identify potential vulnerabilities, while patches are manually verified before release. The service can also provide security fixes across supported release lines without requiring customers to perform a full version upgrade.
TrueSource Trusted Artifacts expands this approach to software libraries and container images. It provides verified builds for Java, Python and Node.js components, along with hardened container images, including Bitnami offerings. Meanwhile, TrueSource Data Services covers enterprise data technologies such as PostgreSQL, RabbitMQ, MySQL and Valkey, providing validated distributions, deployment automation and operational support.
Broadcom’s strategy focuses on supporting the open-source ecosystem by working with upstream maintainers through engineering contributions and funding. With TrueSource, the company aims to give enterprises a way to consume open-source software with additional security and support while balancing automated vulnerability detection with human accountability for critical security fixes.
