An exposition on open source risk and a strategy to mitigate it. If the Log4J issues kept you up at night, if the Elasticsearch licence change caused you headaches, if lack of response from open source projects is driving you to insanity, then this is the talk for you. We will discuss the prevalence of open source in closed source projects, a timeline of identified open source risks, and a proposal to reduce risk. Attendees should come away with concepts and ideas that can be implemented within their own companies to reduce their risk exposure.