My recent conference presentation on open-source security revealed a common theme. Audience members didn’t realize how pervasive open-source is. Everyone in the audience knew that their organization uses a fair number of open-source components, but they thought that it only makes up a small percentage of their applications, at around 30% or less.