Why proprietary software isn’t a retrospective trend but a trap for failure

The telecommunications industry is considering one of its most consequential security debates in decades. Amid growing network complexity, 1 narrative argues that proprietary software is inherently more secure than its open source counterparts. Its central tenet is that the source code is not publicly accessible. 

The logic sounds intuitive: If attackers can’t read the code, they can’t find vulnerabilities. In the era of AI, that argument isn’t just outdated, it’s operationally dangerous.

This blog challenges that narrative. It looks at how AI has changed the economics of vulnerability discovery, why software opacity is no longer a reliable security strategy, and what service providers and network equipment providers (NEPs) must do to build genuine resilience across increasingly hybrid software environments.

Changing software analysis economics

AI has changed how telecommunications providers analyze software. Today's AI reasoning systems can identify insecure logic and surface exploitable conditions without ever seeing the original source. The barrier that closed software has long relied on is dissolving.

This doesn’t infer proprietary software is bad, or that open source is automatically safer. The point is that AI can read a binary as fluently as a person reads documentation, meaning secrecy ceases to be a security strategy. What separates resilient service providers from exposed ones is no longer whether their code is visible. It’s how quickly they can detect, understand, validate, and fix weaknesses across every layer within their network.

Changing vulnerability discovery economics

AI has rewritten the economics of vulnerability discovery. Finding a vulnerability in a closed radio access network (RAN) or core software implementation once took a rare mix of skill and patience. The obstacles were real:

• Sparse or nonexistent external documentation
• Specialized and sometimes obscure programming languages
• A small global pool of genuine domain experts
• Dense, standards-heavy telecommunication protocols
• Highly customized, vendor-specific implementations

A potential attacker would typically spend months or even years building the context needed to reason about a single subsystem. That inertia was the ultimate security model, as it made finding vulnerabilities time-consuming and expensive.

AI collapses that cost. Large language models (LLMs), agentic reasoning systems, automated binary analysis, and AI-assisted reverse engineering now compress work that once took specialized teams years into something far faster and far larger in scale.

Georgetown University’s Center for Security and Emerging Technology has documented how AI agents can autonomously generate fuzzing harnesses, analyze software libraries, interpret the results, and even propose fixes with little human guidance at each step.1 However, AI is a force multiplier for defenders and attackers alike. Defenders can audit their own platforms continuously, but attackers use the same systems to probe them. Retreating toward proprietary and closed systems is actually investing in a barrier that AI has already learned to step over.

Exposing multiple attack vectors

In the era of AI, the logic that proprietary software hides attack vectors no longer holds. Source code is only 1 representation of how a system behaves, and increasingly it’s the least necessary one. Modern AI systems can analyze a deployed solution through everything it exposes to the world around it, including:

• Compiled binaries and firmware images.
• Application programming interfaces (APIs).
• Protocol behavior.
• Memory structures and runtime state.
• Network traffic patterns and timing.
• Live execution paths under varied inputs.

None of these need the source repository. AI tools can extract meaningful behavioral intelligence from proprietary software at unprecedented speed. Tools such as RevEng.AI—along with AI-augmented versions of established platforms like Ghidra—already do exactly that, and the Cloud Security Alliance has shown that LLMs can autonomously discover exploitable vulnerabilities in production software.2 They can even generate working exploit code from a plain-language description. Every one of those surfaces is now machine-readable at scale. Opacity has become a short-lived advantage rather than a long-term security strategy.

Risk traits of proprietary software 

NEPs and independent software vendors (ISVs) ship disciplined, high-quality, and carefully validated products. These proprietary and closed development solutions carry a different risk profile—one that typically stretches out the response cycle once a vulnerability surfaces.

These risks can be mapped to modern security posture metrics shown in Table 1.

Table 1: Modern security posture metrics

These traits add time to investigating and fixing issues once someone finds them. MTTD, MTTU, and MTTR add up to a service provider’s exposure window (the stretch of time during which an adversary can exploit a known but unpatched weakness). Secrecy does nothing to shorten that window; if anything, the very traits that make closed software opaque to outsiders also make diagnosing it from the inside slower. Because AI drives the discovery clock in the attacker's favor, the only durable answer is to drive down your own MTTU and MTTR just as hard.

AI will find weaknesses regardless of the licensing model. AI-assisted security capabilities such as Mythos make this practical: rather than treating open source and proprietary environments as different problems, they apply a single analytical framework across the whole configuration and treat security as an engineering problem rather than an ideological one. The sensible approach is to put AI to work on defense and apply it evenly to every component, whether open or closed, across the entire service provider’s network to:

• Identify vulnerable components wherever they live.
• Map plausible attack paths through the environment.
• Correlate dependencies and transitive exposure.
• Prioritize remediation by real-world risk, not raw Common Vulnerabilities and Exposures (CVE) counts.
• Reduce the manual investigation burden on scarce experts.
• Accelerate the overall security response.

A unified approach is essential. Fragmented tooling that treats open and proprietary software differently creates blind spots at precisely the integration boundaries on which sophisticated attackers focus.

Securing the foundational component of networks

Linux is the overwhelming foundational component of service provider networks. As the same foundational component repeats across the entire service provider network, from the core to the edge, hardening it lifts the posture of the entire architecture. 

A well-maintained, continuously assessed foundation supports everything that rests upon it. An unmanaged one drags down even the most carefully engineered application higher in the architecture. The foundation is where resilience should be built by design—not bolted on after an incident. Pairing a trusted platform like Red Hat Enterprise Linux with AI-driven vulnerability analysis allows service providers to build security directly into the operating layer that:

• Reduces baseline infrastructure risk.
• Automates security validation.
• Improves and evidences regulatory compliance.
• Accelerates patch readiness. 
• Simplifies lifecycle management across distributed networks.
• Continuously assesses platform health.

Rather than learning about exposure after an adversary does, a continuously assessed platform surfaces and validates issues on its own schedule. The operating foundation stops being a passive dependency and plays a pivotal role in a service provider’s defense strategy.

Adopting a security-focused foundation doesn’t force a choice between open source and proprietary software. It provides a well-understood platform on which both can operate.

Why open source reigns supreme

While proprietary models rely on control, open source delivers unmatched resilience, transparency, and agility. The advantages of open source lie in:

• Broad and continuous global peer review.
• Transparent development in the open.
• Rapid public disclosure of issues.
• Collaborative and distributed remediation.
• Testing across diverse real-world environments.
• True ownership and flexibility.

Proprietary software models rely heavily on centralized control, vendor lock-in, and strict release gates. While this offers structured support paths, it creates single points of failure, slower fix cycles, and a reliance on security through secrecy.

AI has effectively eliminated the artificial "security benefit" of closed source code. AI tools make proprietary binaries and compiled code easy to analyze and reverse-engineer, stripping away the illusion of safety through obscurity. What matters now is remediation velocity and collective intelligence—how quickly vulnerabilities are spotted, understood, and patched across the entire ecosystem. This is where open source wins.

Conclusion

The speed and effectiveness of security will differentiate a service provider in a competitive and sovereign market. The future will be adopting a hybrid security approach, as service provider networks will be a mix of proprietary applications, commercial software, open source technologies, AI platforms, and cloud-native infrastructure.

Service providers that adopt AI-assisted vulnerability management will be in the best position to harden their proprietary and open source environments at the same time. Sustaining resilience depends on detection, automation, rapid remediation, and a secure platform foundation—not on whether software is open or proprietary: 

• AI has changed the rules of discovery. Vulnerabilities can now be found without source access by analyzing binaries, firmware, APIs, and runtime behavior, which makes code secrecy an increasingly unreliable security strategy.
• Resilience is about speed, not visibility. Long-term cyber resilience depends on detection, automation, rapid remediation, and a security-focused platform foundation, not on whether software is open or proprietary. The most secure organizations are those with the most efficient automated security operations.
• Invest in AI-driven security and hardened Linux. Service providers and NEPs should strengthen the hybrid environments powering modern RAN, core, and edge networks at the foundation, with AI applied uniformly across every layer. Because Linux underpins the entire configuration, hardening it delivers compounding security benefits everywhere above it.

Going back to proprietary software isn’t a return to safety. It’s a retreat into a barrier that AI has already learned to walk through.

To find out more, visit the Red Hat telecommunications page; explore Lightwell, a joint initiative between Red Hat and IBM focused on securing the open source software supply chain; or contact a Red Hat representative today. 

Special thanks to these Red Hat team members for their valuable feedback: Volker Tegtmeyer, Jim Sbordon, Fatih Nar, Christof Stallmach, Michael Tadault, and David Kypuros.

Rohlf, Chris. “AI and the Software Vulnerability Lifecycle.” Center for Security and Emerging Technology, 4 Aug. 2025.

2 Evron, Gadi, et al. “The ‘AI Vulnerability Storm’: Building a ‘Mythos-ready’ Security Program.” Cloud Security Alliance, 12 April 2026.