Paul Mandl

Peter Mandl, Paul Mandl

Identifying known software vulnerabilities is a central task in software supply chain security management. Although publicly available vulnerability information is based on shared standards, different vulnerability scanners often report divergent results for identical software inventories. These differences do not arise solely from individual data sources or scanner implementations. They can emerge at several stages of the open-source vulnerability ecosystem. This paper presents a conceptual framework that describes vulnerability management as a distributed process of information exchange and transformation. It traces vulnerability information from its creation and standardization through enrichment to context-dependent interpretation. The analysis identifies heterogeneous information sources, divergent identity and version models, temporal change, and context-dependent assessment as major causes of inconsistent scanner findings. It then discusses the implications for interpreting analysis results, designing reproducible evaluation methods, and handling dynamic vulnerability knowledge in practice.

Peter Mandl, Paul Mandl, Martin Häusl et al.

Automated vulnerability detection tools are widely used to identify security vulnerabilities in software dependencies. However, the evaluation of such tools remains challenging due to the heterogeneous structure of vulnerability data sources, inconsistent identifier schemes, and ambiguities in version range specifications. In this paper, we present an empirical evaluation of vulnerability detection across multiple software ecosystems using a curated ground-truth dataset derived from the Open Source Vulnerabilities (OSV) database. The dataset explicitly maps vulnerabilities to concrete package versions and enables a systematic comparison of detection results across different tools and services. Since vulnerability databases such as OSV are continuously updated, the dataset used in this study represents a snapshot of the vulnerability landscape at the time of the evaluation. To support reproducibility and future studies, we provide an open-source tool that automatically reconstructs the dataset from the current OSV database using the methodology described in this paper. Our evaluation highlights systematic differences between vulnerability detection systems and demonstrates the importance of transparent dataset construction for reproducible empirical security research.

Peter Mandl, Paul Mandl

Generative AI is transforming software development from localized tool support into development work that is embedded in processes, tools, and organizational structures. Its use now extends beyond code completion to requirements, architecture, implementation, testing, review, operations, and maintenance. Existing research shows a differentiated picture. Productivity gains are possible, but depend on task type, codebase characteristics, and developers' experience. At the same time, AI-generated artifacts require additional control and governance. Building on these observations, this paper develops a pragmatic organizing framework for the transition toward AI-driven Software Development. It describes a progression from informal and assistive AI use through integrated AI workflows toward controlled agentic development processes. The focus is not on individual tools or models, but on the technical, organizational, and quality-assurance mechanisms needed to embed AI across central software engineering activities. Particular importance is assigned to a harness that connects project context, tool access, verification, permissions, logging, and human approval. The paper draws on current research, practice-oriented sources, established software engineering practices, and project experience. A mid-sized software company is used as an exploratory case study to assess the plausibility of the framework and to illustrate how prerequisites, governance requirements, design practices, and transformation paths can be shaped in a concrete organizational context. The paper provides a conceptual basis for further scholarly discussion and empirical investigation of AI-driven Software Development.