Topic starter
02/08/2026 12:07 pm
TL;DR: One in three respondents report over 60% of their organisation’s code is written by AI, yet only 18% have any AI governance in place, leaving models, MCPs, agents, datasets, and libraries embedded in codebases without inventory or control, according to Checkmarx. The governance problem is now supply-chain management, not just AppSec hygiene.
Editorial analysis by NHI Mgmt Group, based on content published by Checkmarx: “The AI Inventory Gap: Why Your Organization Has No Idea What AI Assets Are Part of Your Software Supply Chain”.
Key questions
Q: What breaks when AI systems are deployed without a complete inventory?
A: Governance breaks first, then auditability.
Q: Why do untracked AI components create supply-chain risk?
A: They can enter builds with unknown origin, unreviewed behaviour and delegated access to data or tools.
Q: How should teams govern AI agents that can reach APIs, events, and memory?
A: Teams should govern those agents as runtime identities, not as isolated integrations.
Practitioner guidance
- Establish a single owner for AI inventory Give one function explicit authority for discovering, classifying and approving AI assets across repos, pipelines and runtime environments.
- Run deterministic discovery across priority codebases Scan the most critical repositories, services and container images for models, MCP servers, agent frameworks, prompts and AI libraries.
- Classify AI assets by type and trust boundary Tag each discovered asset as model, dataset, agent, MCP server, prompt or library, then record whether it can access tools, data or services.
Bottom line: AI supply chains go blind when models, agents, MCP servers and libraries are shipped without inventory, provenance or policy controls.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:12 pm
AI inventory is now a supply-chain control problem, not a tooling preference. The moment models, datasets, MCPs and agent frameworks enter codebases, they become governed dependencies that need inventory, provenance and policy boundaries. Traditional AppSec can find unsafe usage patterns, but it cannot govern an asset the organisation does not know exists. The practitioner conclusion is simple: build AI inventory as a first-class control plane, not a side spreadsheet.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should security teams do first to close AI inventory gaps?
A: Start with deterministic discovery on the highest-risk repos and services, then classify every AI artifact by type, origin and access scope. That gives security and platform teams a defensible baseline for policy, provenance checks and build-time enforcement.
👉 Read our full editorial: AI inventory gaps are turning software supply chains blind