When bugs are discovered, such as Heartbleed -- an exploitable vulnerability in a component of OpenSSL -- vendors are responsible for patching these issues, but the report suggested that many companies have a lack of visibility into their own applications and just how much they rely on open-source components.