Commercial off the shelf software is a ready made product a buyer licenses from a vendor instead of paying for a fully custom build of the same job.
The buyer gains speed and a vendor's roadmap, and also accepts that security fixes, defaults, and features arrive on the vendor's schedule.
How it works
Because many customers run the same product, a flaw can matter to all of them at once, which makes inventory and patch timing part of security rather than only procurement.
Custom changes on top of the product can block upgrades, so teams should prefer configuration over edits they cannot maintain.
Suppliers of these products become part of your risk, so ask how they handle vulnerabilities, what telemetry they collect, and how long a version stays supported.
A cheap license that never receives fixes is an expensive incident waiting for a trigger.
Concrete examples
- A hospital buys a scheduling product used by many peers and must apply the vendor's security update in the same busy week.
- A local customization prevents an upgrade, so the hospital keeps running a version the vendor no longer fixes.
- A finance team chooses a packaged ledger and relies on the vendor to publish fixes for newly announced flaws.
Protective measures
- Keep an inventory of packaged products, versions, and the dates when vendor support ends.
- Prefer supported configuration over local code changes that will block the next security update.
- Subscribe to vendor advisories and decide in advance who may approve an emergency update.
- Ask vendors how they report flaws and what data their product sends out before you deploy it widely.
Related articles
The article What is bring your own license? explains bringing a license you already own into another environment.
The article What is cloud security in practice? covers protecting packaged software when it runs on rented infrastructure.
The article What is compliance monitoring? shows how vendor duties for bought software should be checked over time.