Broadcom today introduced a new software suite called TrueSource at the VMware Explore 2026 conference in Las Vegas. The product line provides enterprise support and security for open-source software, with a focus on verified, human-checked code. The company developed this suite to give organizations a reliable way to manage and secure their open-source dependencies without relying solely on automated systems.
The release comes at a time when many companies are eager to automate software maintenance. As AI tools become more common in the development cycle, there is pressure to use them for security patching to keep up with the speed of cyberattacks. However, Broadcom suggests that fully automated patching carries significant risks. To support this, the company cited recent research from 1Password’s Off-by-1 Labs. The study found that out of 6,000 AI-generated patches, only 26 percent successfully fixed the security issue without causing other application errors. These findings suggest that current AI tools are not yet capable of replacing human oversight in critical security tasks.
Broadcom’s strategy with TrueSource rests on the idea that security remains a human discipline. Instead of creating automated tools that attempt to work around software maintainers, Broadcom intends to work with them. The company contributes fixes upstream and supports community maintainers through both funding and engineering time.
The TrueSource portfolio is divided into three primary components:
Spring Enterprise
This service acts as the flagship offering for the Spring ecosystem. It provides proactive security scanning for Spring and its entire dependency tree. Broadcom engineers scan the code using models to find vulnerabilities, and then they verify every patch by hand before releasing it. A key benefit is that patches are issued for every supported release line simultaneously, often before a vulnerability is publicly disclosed. This ensures that no version is left waiting for a fix. Furthermore, the offering provides security patches that are independent of full version upgrades. This allows security teams to apply necessary fixes in hours rather than weeks, which reduces the need for extensive testing cycles.
TrueSource Trusted Artifacts
This component extends Broadcom’s security model to a wider range of software. It provides secure, verified builds for libraries across the Java ecosystem, as well as Python and Node.js. In addition to libraries, the offering includes a catalog of hardened container images, such as those from Bitnami. These artifacts are curated to ensure they follow a reference architecture and are fully supportable by the original maintainers. Broadcom uses these same artifacts across its own software divisions, ensuring they meet the standards required by organizations running critical infrastructure.
TrueSource Data Services
The third component brings the TrueSource promise to the data tier. This service supports engines that enterprise applications depend on, including PostgreSQL, RabbitMQ, MySQL, and Valkey. Patching data engines is complex because a flawed update could risk the data itself. Broadcom provides validated distributions, deployment automation, and operational support to ensure these engines remain secure.
Across all three areas, Broadcom has implemented a shared set of principles. Automation tools scan customer repositories to assess the impact of new releases before they are used. If a customer identifies a vulnerability that is not yet public, they can work with Broadcom for early access to remediation.
Broadcom stated that these offerings are available through tiered site licensing. By focusing on engineering accountability rather than machine generation, the company aims to provide a path for large businesses to consume open source software with confidence, balancing speed with the need for stable, secure operations.