NYU Tandon Launches Initiative to Close a Critical Gap in Open Source Security and Train the Students Who Will Fill It

New program embeds master’s students directly in major open-source communities for a year of hands-on security work, addressing a widening vulnerability in the software the internet depends on.

NYU Tandon School of Engineering announced today that it has launched the NYU Software Supply Chain Security Operations Center (NSOC), a new initiative in the NYU Center for Cybersecurity (CCS) whose centerpiece is a one-year program that embeds Tandon master’s students directly in the open-source communities that maintain critical software infrastructure.

Modern software is built largely on open-source code, freely available components that developers assemble into applications rather than writing everything from scratch, much like a manufacturer relies on parts from many different suppliers. The average application now depends on more than 1,100 of these components.

These dependencies, which are a crucial part of the software supply chain, are largely maintained by small volunteer teams with no security staff to call on. When one component is compromised, as happened in the 2020 SolarWinds breach, the effects can spread across the entire software ecosystem and threaten critical infrastructure.

"There is simply not enough security expertise, tooling, or guidance to tackle the scale of this problem," said Justin Cappos, professor at NYU Tandon and founder of NSOC, who has developed a collection of widely-used software supply chain security technologies including TUF, Uptane, gittuf, and in-toto. "The only way to actually close that gap is to train the people who can fill it, and to train them by putting them directly into the communities that need the help."

"A project like NSOC doesn't exist anywhere in the world, whether in academia or in the open-source world itself," said Cappos, who is also a current Fulbright Iceland Distinguished Scholar. "We're not just teaching students the skills. We're giving them a year to learn and take on real security work, which is exactly the kind of experience that turns a good student into an expert the field needs."

Each NSOC student will join as a dedicated liaison to a single open-source ecosystem, such as Python, the Linux kernel, the Maven community, Rust, Forgejo, or Ruby, a deliberate departure from short-term placements like summer internships, which Cappos said rarely give students enough time to earn real standing in a community.

Students will begin with onboarding in their assigned ecosystem's norms and technical expectations, before performing actual work, including respectfully helping maintainers manage security risks, evaluate vulnerabilities, and implement concrete improvements to widely used software. Students also gain hands-on experience applying AI models to vulnerability discovery and patching.

The program is credit-bearing and includes funded conference travel, connecting students directly with the maintainers behind their assigned ecosystems. According to Cappos, the goal is for students to leave the program as recognized contributors in their field.

Cappos co-founded NSOC with Jiahao Yu, a professor at NYU Abu Dhabi focused on AI-driven vulnerability discovery, alongside external collaborators Andrew Nesbitt of ecosyste.ms and Vlad-Stefan Harbuz of the Software Stewardship Lab and Open Source Pledge.

Beyond the student program, NSOC will also conduct ongoing monitoring of major open-source ecosystems and will publish annual security assessments, an effort separate from any single cohort. This work is powered by ecosyste.ms, a platform that tracks millions of open-source packages and repositories worldwide, giving students and researchers a way to spot emerging risks before they turn into real incidents.

The inaugural cohort of 8 to 10 students is expected to begin in January 2027. Interested students are encouraged to enroll in NYU Tandon's Software Supply Chain Security and Application Security courses in Fall 2026 to prepare.

Google and DTCC, the premier post-trade market infrastructure for the global financial services industry, provided support to the launch of this program.