Building the language of software transparency.

I have been deeply immersed in software supply chain security for more than a decade, founding and chairing the open standards that now define how organizations describe and exchange software transparency information.

My journey with the Open Worldwide Application Security Project (OWASP) began in 2012. I am a lifetime OWASP member and currently serve as Chair of the OWASP Global Board of Directors, helping drive the continued growth of the foundation and its mission to make secure software a reality through open collaboration, education, and innovation.

Alongside board service, I founded and chair the OWASP CycloneDX Core Working Group. What began as an OWASP project has grown into one of the most widely adopted SBOM standards in the world and, in 2024, became an international standard through Ecma International as ECMA‑424. I also lead the OWASP Dependency‑Track project, which recently celebrated its ten year anniversary, and coauthored the OWASP Software Component Verification Standard (SCVS), which is referenced in its entirety in the NIST Secure Software Development Framework.

I founded Ecma International Technical Committee 54 (TC54) and chaired it during its first two years. TC54 is the home of the international standards program on software and system transparency, including CycloneDX, Package‑URL, OWASP Common Lifecycle Enumeration (CLE), and the Transparency Exchange API. This work is reshaping how software evidence is discovered, exchanged, and verified across the supply chain.

Outside of standards and advisory work, I write, speak, and teach. I am passionate about helping organizations identify and reduce risk from the software they build and consume, and I believe the next decade of security gains will come from better transparency rather than better perimeters.