Have you considered using LLMs to perform some automated more-or-less reliable classification of incoming reports by severity, affected product, etc., then have agents try to replicate the reported findings?
Ideally the reports would also be coming in in the same structured format.
I recall the AUR always being touted very highly as some great advantage for Arch as a linux distro, unfortunately this convenience has also come with a price.
It's crazy that all it takes to become a maintainer of a package is to flag it as orphaned, wait 2 weeks for the original maintainer to fail to respond because they're on a holiday, and BAM! - the attacker can gets assigned as a maintainer and can now ship spicy updates.
Firecracker and gVisor are used by AWS and GCP, respectively, are open source. That's just off the top of my head, I'm sure there's more, there's also the whole Open Compute Project, after all.
That's a problem that can be encountered by companies that don't think through how remote work is supposed to work at their workplace. It's easier to craft processes when everyone is remote (i.e. if the company is remote-first).
If getting the best developers for your budget isn't a priority, hiring remotely allows you to stretch your runway further.
I wanted to reply to your comment re:Nordics but it seems it reached a limit to comment depth, your experiences are probably related to interacting with a biased sample, a quick google tells me that on average only a couple hundred Swedes immigrate to the US per year.
Ideally the reports would also be coming in in the same structured format.