Notifications
Clear all
Topic starter
02/08/2026 12:07 pm
TL;DR: One in three respondents report over 60% of their organisation’s code is written by AI, yet only 18% have any AI governance in place, leaving models, MCPs, agents, datasets, and libraries embedded in codebases without inventory or control, according to Checkmarx. The governance problem is now supply-chain management, not just AppSec hygiene.
NHIMG editorial — based on content published by Checkmarx: AI assets are already embedded in the software supply chain
By the numbers:
- 60% of their organisation’s code is written by, r organisation’s code is written by AI.
- Only 18% have any sort of AI governance in place.
- 80% of organisations report their AI agents have already performed actions beyond their intended scope.
Questions worth separating out
Q: How should security teams build an AI inventory that is actually governable?
A: Start with a single authoritative record that captures the model or tool, the business use case, the dataset lineage, the owning team, the deployment environment, and the current governance status.
Q: Why do AI supply chains create identity and access risk?
A: Because AI systems rely on service accounts, API keys, federation paths, and delegated tool permissions.
Q: What do organisations get wrong about AI governance and identity controls?
A: They often separate AI governance from identity governance, even though AI systems can shape access, code, and security decisions.
Practitioner guidance
- Define a single accountable owner for AI inventory Assign one function with authority over models, MCPs, agent frameworks, datasets, and AI libraries so other teams know where governance decisions live.
- Build a deterministic AI asset inventory Run discovery across repositories, container images, and services to identify embedded AI assets by type, version, provenance, and runtime location.
- Classify AI assets by access and trust level Tag each asset as model, dataset, prompt, library, MCP server, or agent framework, then map what data and tools it can access.
What's in the full article
Checkmarx's full article covers the operational detail this post intentionally leaves for the source:
- The AI asset inventory workflow for models, datasets, agent frameworks, MCP servers, prompts, and libraries
- The specific governance actions the vendor recommends for building inventory and policy into delivery workflows
- The practical distinctions between AppSec scanning, supply-chain control, and AI-specific governance
- The article’s examples of how untracked AI assets create blind spots in real development environments
👉 Read Checkmarx’s analysis of AI assets in the software supply chain →
AI inventory gaps in software supply chains: what should teams do now?
Explore further
02/08/2026 1:12 pm
AI supply chain security is becoming an identity problem, not just an AppSec problem. Once a model, MCP, or agent framework can access tools and data, it behaves like a non-human identity with privileges that need lifecycle control. That shifts the governance question from code scanning to ownership, scope, and revocation. Organisations that keep treating these assets as passive dependencies will miss the access risk embedded in runtime AI behaviour.
A question worth separating out:
Q: How can teams reduce risk from AI-generated code in supply chains?
A: Teams should apply the same provenance and review expectations to AI-generated code as they do to third-party dependencies. That means verifying source, tightening review on generated changes, and blocking untrusted artifacts from reaching deployment. The goal is to prevent automation from scaling uncertainty faster than governance can absorb it.
👉 Read our full editorial: AI inventory gaps are turning software supply chains blind
