Small IT firms depend on external software packages to develop and maintain applications. However, weaknesses in these packages can expose business systems and customer information to security risks. This study will examine software dependency vulnerabilities and remediation practices in small IT firms in Pune and Mumbai. It will track selected software projects over six months through monthly dependency scans, maintenance records, and interviews with developers and project managers. The analysis will consider vulnerability severity, dependency age, patch availability, and the time taken to resolve identified issues. Direct and indirect dependencies will be examined separately to understand differences in security exposure.

The study will compare remediation practices across firms with different team sizes, development processes, and security resources. Statistical analysis will assess relationships between regular scanning, assigned security responsibilities, automated alerts, and remediation time. Interview responses will help explain delays linked to compatibility concerns, limited staff, testing requirements, and delivery deadlines. Repeated observations will distinguish newly identified vulnerabilities from unresolved issues and examine changes in exposure over time. The research aims to identify practical measures that small firms can use to improve dependency monitoring and patch management. Its intended contribution is evidence to support affordable security practices within small development teams.