Oct. 1, 2026 /PRNewswire/ — Riverside Research, a defense technology nonprofit focusing on intelligence, announced a collaboration with Kitware, Inc., a custom software and AI developer, to develop capabilities that enable organizations to securely and reliably deploy software patches and updates for fielded software inventories
Modern software products often incorporate hundreds or thousands of third-party software components, creating complex dependency networks that can make vulnerability remediation exceptionally challenging. In many cases, updating a critical software component is comparable to replacing a faulty engine part while a vehicle is traveling at highway speeds, requiring precision, reliability, and minimal disruption to ongoing operations.
One of the world’s most widely used software build tools, CMake, manages software inventories by defining software components and their dependencies. Through this collaboration, Riverside Research and Kitware enhanced CMake with native software inventory capabilities that embed critical metadata directly within those inventories.
Riverside Research has developed tools that enable fielded system maintainers to leverage this embedded metadata, improving their ability to identify, update, and repair software systems while maintaining operational continuity.
This contrasts with existing approaches to software inventory management, which rely on external scanning tools, self-reporting practices, or a combination of the two. Depending on external tools or providers introduces potential ambiguities and limits coverage.
“Software developers have long relied on CMake as the authoritative source for defining how applications are built and how their dependencies fit together,” said Bill Hoffman, co-founder of Kitware and lead architect of CMake. “By integrating software inventory generation directly into the build system, we’re making that same trusted information available for security, maintenance, and risk management activities. Our collaboration with Riverside Research helps ensure organizations can understand and maintain increasingly complex software ecosystems with greater accuracy, confidence, and efficiency.”
How Riverside Research and Kitware Create More Accurate Cyber Risk Tracking in CMake
Riverside Research and Kitware’s integration of software inventory generation directly into CMake allows organizations across government and industry to more accurately track their cyber risk, reducing the likelihood and impact of crippling attacks on the nation’s software supply chain, a known national security risk that the federal government continually mitigates.
Embedding software inventories directly into the build itself provides:
- Authoritative dependency modeling
- Deterministic output tied to configuration
- Continuous Integration -friendly automation
- Reproducible results
“CMake’s adoption of software inventories marks a significant step toward improving software security and visibility for millions of C++ developers,” said Dr. Gordon Stewart, Associate Director of Secure and Resilient Systems at Riverside Research. “We are excited by this partnership with Kitware and look forward to the further impact of E-BOSS technologies.”
CMake Enhancements Result of Defense Advanced Research Projects Agency (DARPA) Funding
The companies developed this CMake enhancement with funding from DARPA under the Enhanced Software Bill of Materials (SBOM) for the Optimized Software Sustainment (E-BOSS) program.
DARPA’s development initiatives answer recent federal guidance, which emphasizes flexible, risk-based approaches to software and hardware assurance, enabling agencies to tailor security practices to mission needs. Within such frameworks, CMake’s software inventories support risk-informed decision-making, enabling agencies to manage their cyber risk without undue compliance overhead.
CMake’s native software inventories give organizations access to advanced software supply-chain capabilities without additional tooling or setup, providing flexibility to apply cyber risk reduction strategies according to agency operational and security needs.
Projected Impact of CMake Improvements
The E-BOSS program advances technologies that improve how software systems are understood, maintained, and secured over time. Future work will aim to enable seamless integration of E-BOSS performer technologies into the software inventories now provided natively by CMake, working to streamline the adoption of E-BOSS rapid vulnerability triage and remediation across government and industry.
Other ongoing work includes richer metadata modeling, improved handling of transitive dependencies, enhanced license reporting, and tighter integration with packaging and CI workflows.
Riverside Research is a national security nonprofit serving the DOW and Intelligence Community. Through the company’s Open Innovation Center (OIC), they invest in multidisciplinary research and development and encourages collaboration. Riverside Research’s areas of expertise include Object and Activity Detection; Accelerated AI/ML; Zero Trust; Open Architectures; Computational Electromagnetics; Plasma Physics; Precision Timing; Terahertz Imaging; Commercial Intelligence, Surveillance, and Reconnaissance (ISR); Collection Planning; and more. Learn more at www.riversideresearch.org.
About Kitware, Inc.
Kitware advances science and technology to make a meaningful difference in the world. They deliver high-impact software solutions built on open-source foundations, combining deep technical expertise with a collaborative, people-first approach. Trusted by commercial, government, and academic organizations, Kitware partners closely with customers to understand their goals and integrate robust, sustainable technology into real-world scenarios. They build solutions that endure by prioritizing transparency, long-term value, and positive impact. Founded in 1998, Kitware is 100% employee-owned. Visit them at kitware.com or on Twitter, LinkedIn, and YouTube.
