Operational Risk

Learn how Xray identifies operational risk and calculates severity.

Beyond security vulnerabilities and compliance issues, operational risks in software components can impact system reliability, maintainability, and overall software quality. These risks arise from outdated, deprecated, or unmaintained dependencies that may no longer receive updates, security patches, or community support.

JFrog Xray provides Operational Risk Analysis so you can detect and mitigate risks before they affect production environments. By identifying software components with end-of-life (EOL) statuses, deprecated libraries, and maintenance concerns, you can make informed decisions to maintain software stability and long-term viability.

What Is Operational Risk in Software?

Operational risk refers to non-security-related issues that can affect a software component’s performance, reliability, or maintainability.

The package types currently supported are npm and Maven.

Common operational risks include:

End-of-life software: Components that no longer receive updates or security patches.
Deprecated dependencies: Libraries that are obsolete or replaced by newer versions.
Unmaintained open-source projects: Software that hasn’t been updated for a long period,
increasing the risk of compatibility issues.
High-impact component updates: Major version changes that introduce breaking changes or API modifications.
Abandoned projects: Open-source components with no active contributors or maintainers.

How Xray Detects Operational Risks

Xray continuously monitors software components in repositories, builds, and Release Bundles, identifying key operational risks based on:

Version stability: Detects if a component hasn't been updated for an extended period.
End-of-life status: Flags software that has reached EOL and no longer receives support.
Community and maintenance health: Analyzes activity levels of open-source maintainers.
API and compatibility changes: Identifies major version changes that may introduce breaking updates.
License status changes: Notifies you when license modifications impact compliance.

Operational Risk Workflow in Xray

Create an Operational Risk Policy.
Attach Policy to Watch.
View Operational Risk Data in Xray > Scans List. For more information, see Understanding and Analyzing Xray Scan Results.
View Operational Risk violations generated based on the Policy rules you set.

Mitigating Operational Risks with Xray

1. Monitor Dependencies Continuously

Apply Operational Risk Policies to repositories and builds.
Detect outdated and deprecated dependencies before they impact production.

2. Enforce Governance in CI/CD Pipelines

Configure Xray to fail builds if they contain high-risk operational components.
Require dependency reviews before promoting artifacts.

3. Plan for End-of-Life Transitions

Track EOL software and migrate to actively maintained alternatives.
Avoid dependencies that lack long-term maintenance support.

4. Establish a Risk Management Strategy

Regularly audit software dependencies for compatibility and lifecycle health.
Work with open-source communities to assess long-term viability.

How Xray Determines Operational Risk Severity

Xray calculates Operational Risk as High, Medium, Low, and None, meaning no known risk, using the following criteria.

Risk	Type	Severity	Notes
End-of-life	Boolean	High = True None = False
Version age	Number	Number of months since release / 10 High >= 4 Medium > 2 and < 4 Low > 1 and <= 2 None, no risk <= 1
Number of new versions	Number	Number of versions since / 2 High >= 6 Medium >= 4 and < 6 Low >= 2 and < 4 None, no risk < 2
Health of open source project	Release cadence per year	Healthy >= 2 releases Unhealthy <= 1	This includes all releases, including dot releases and patch releases if they are general availability releases. When there's no data, Xray presumes it's healthy.

The following table shows how Xray calculates Operational Risk effective severity.

Number	EOL	Health	Number of New Versions	Version Age	Combine Severity	Risk Reason
1	High	Any	Any	Any	High	EOL
2	None	High Risk	Any	Any	High	Health
3	None	No Risk	High	None, Low, Medium, High	High	Number of new versions and version age, only when High
4	None	No Risk	Medium	None, Low, Medium	Medium	Number of new versions and version age, only when Medium
5	None	No Risk	Low	None, Low	Low	Number of new versions and version age, only when Low
6	None	No Risk	None	None	None	No given reason
7	None	No Risk	None, Low, Medium, High	High	High	Version age and number of new versions, only when High
8	None	No Risk	None, Low, Medium	Medium	Medium	Version age and number of new versions, only when Medium
9	None	No Risk	None, Low	Low	Low	Version age and number of new versions, only when Low