"This is a huge problem in the corporate world with open source. It's like a fog of war, they don't see far enough down the software supply chain of what's powering everything."