Riverside Research and Kitware have enhanced CMake, a widely used software build tool, to improve how organisations deploy software updates and manage security vulnerabilities. The collaboration, funded by DARPA's Enhanced Software Bill of Materials programme, integrates software inventory capabilities directly into CMake's build system. Modern software often incorporates thousands of third-party components, creating complex dependency networks that complicate vulnerability remediation. The enhancement embeds critical metadata within software inventories, enabling system maintainers to identify and update software whilst maintaining operational continuity. This approach differs from existing methods that rely on external scanning tools or self-reporting, which can introduce ambiguities. The integration provides authoritative dependency modelling and reproducible results, helping organisations across government and industry track cyber risk more accurately. Future work will focus on richer metadata modelling and improved handling of transitive dependencies.

Riverside Research and Kitware, Inc. strengthen Secure deployment of software updates across complex software ecosystems. Oct 01, 2026, 10:40 AM ET WASHINGTON, Oct. 1, 2026 /PRNewswire/ - Riverside Research, a defense technology nonprofit focusing on intelligence, announced a collaboration with Kitware, Inc., a custom software and AI developer, to develop capabilities that enable organizations to securely and reliably deploy software patches and updates for fielded software inventories. Modern software products often incorporate hundreds or thousands of third-party software components, creating complex dependency networks that can make vulnerability remediation exceptionally challenging. In many cases, updating a critical software component is comparable to replacing a faulty engine part while a vehicle is traveling at highway speeds, requiring precision, reliability, and minimal disruption to ongoing operations. One of the world's most widely used software build tools, CMake, manages software inventories by defining software components and their dependencies. Through this collaboration, Riverside Research and Kitware enhanced CMake with native software inventory capabilities that embed critical metadata directly within those inventories. Riverside Research has developed tools that enable fielded system maintainers to leverage this embedded metadata, improving their ability to identify, update, and repair software systems while maintaining operational continuity. This contrasts with existing approaches to software inventory management, which rely on external scanning tools, self-reporting practices, or a combination of the two. Depending on external tools or providers introduces potential ambiguities and limits coverage. "Software developers have long relied on CMake as the authoritative source for defining how applications are built and how their dependencies fit together," said Bill Hoffman, co-founder of Kitware and lead architect of CMake. "By integrating software inventory generation directly into the build system, we're making that same trusted information available for security, maintenance, and risk management activities. Our collaboration with Riverside Research helps ensure organizations can understand and maintain increasingly complex software ecosystems with greater accuracy, confidence, and efficiency." How Riverside Research and Kitware Create More Accurate Cyber Risk Tracking in CMake Riverside Research and Kitware's integration of software inventory generation directly into CMake allows organizations across government and industry to more accurately track their cyber risk, reducing the likelihood and impact of crippling attacks on the nation's software supply chain, a known national security risk that the federal government continually mitigates. Embedding software inventories directly into the build itself provides: * Authoritative dependency modeling * Deterministic output tied to configuration * Continuous Integration -friendly automation * Reproducible results "CMake's adoption of software inventories marks a significant step toward improving software security and visibility for millions of C++ developers," said Dr. Gordon Stewart, Associate Director of Secure and Resilient Systems at Riverside Research. "We are excited by this partnership with Kitware and look forward to the further impact of E-BOSS technologies." CMake Enhancements Result of Defense Advanced Research Projects Agency (DARPA) Funding The companies developed this CMake enhancement with funding from DARPA under the Enhanced Software Bill of Materials (SBOM) for the Optimized Software Sustainment (E-BOSS) program. DARPA's development initiatives answer recent federal guidance, which emphasizes flexible, risk-based approaches to software and hardware assurance, enabling agencies to tailor security practices to mission needs. Within such frameworks, CMake's software inventories support risk-informed decision-making, enabling agencies to manage their cyber risk without undue compliance overhead. CMake's native software inventories give organizations access to advanced software supply-chain capabilities without additional tooling or setup, providing flexibility to apply cyber risk reduction strategies according to agency operational and security needs. Projected Impact of CMake Improvements The E-BOSS program advances technologies that improve how software systems are understood, maintained, and secured over time. Future work will aim to enable seamless integration of E-BOSS performer technologies into the software inventories now provided natively by CMake, working to streamline the adoption of E-BOSS rapid vulnerability triage and remediation across government and industry. Other ongoing work includes richer metadata modeling, improved handling of transitive dependencies, enhanced license reporting, and tighter integration with packaging and CI workflows. About Riverside Research Riverside Research is a national security nonprofit serving the DOW and Intelligence Community. Through the company's Open Innovation Center (OIC), they invest in multidisciplinary research and development and encourages collaboration. Riverside Research's areas of expertise include Object and Activity Detection; Accelerated AI/ML; Zero Trust; Open Architectures; Computational Electromagnetics; Plasma Physics; Precision Timing; Terahertz Imaging; Commercial Intelligence, Surveillance, and Reconnaissance (ISR); Collection Planning; and more. Learn more at www.riversideresearch.org. About Kitware, Inc. Kitware advances science and technology to make a meaningful difference in the world. They deliver high-impact software solutions built on open-source foundations, combining deep technical expertise with a collaborative, people-first approach. Trusted by commercial, government, and academic organizations, Kitware partners closely with customers to understand their goals and integrate robust, sustainable technology into real-world scenarios. They build solutions that endure by prioritizing transparency, long-term value, and positive impact. Founded in 1998, Kitware is 100% employee-owned. Visit them at kitware.com or on Twitter, LinkedIn, and YouTube. SOURCE RIVERSIDE RESEARCH NOTE: This content is not written by or endorsed by "KSWB", its advertisers, or Nexstar Media Inc.