A development team must choose between an open-source cryptography library and a proprietary SDK with similar features. The security team requires the ability to inspect the source code during reviews and has staff available to track and apply updates itself. Which statement accurately reflects a security implication of choosing the open-source library?

Open-source software makes its source code available, so an organization can conduct its own security review, verify how algorithms are implemented. That transparency fits the stated requirement to inspect code. The trade-off is that support usually comes from a community rather than a contracted vendor, so the organization must monitor for vulnerability disclosures, track releases, and apply updates itself, which this team has staff to do. Claiming open source is inherently secure because of public visibility is false; widely used open-source projects have contained serious vulnerabilities that went unnoticed for years, so visibility enables review but does not guarantee it occurred. Claiming open source is less secure because publishing code helps attackers relies on security through obscurity; proprietary code is also analyzed by attackers through reverse engineering, and hiding code does not remove flaws. A guaranteed contractual patch schedule describes a commercial support agreement, typically associated with proprietary products or paid support, not a property of open-source code itself. Exam caveat: neither model is inherently more secure; the deciding factors are review capability, support arrangements, patch responsiveness, and the organization's ability to maintain what it adopts. Operational check: record the library in the software inventory, subscribe to its security advisories, pin and verify versions, and include it in dependency scanning.