Enterprise AI
Software supply chain security
Also known as: software supply chain, SBOM security, supply chain security
Software supply chain security is the practice of securing every component, tool and process used to build, package and deliver software, including open source dependencies, build systems and deployment pipelines. It treats third party code and build infrastructure as part of the attack surface, not as trusted background plumbing. Common controls include software bills of materials, dependency scanning, signed artefacts and hardened CI/CD.
What it is
It covers the people, code and systems that contribute to a finished application, from an open source package pulled at build time to the container registry that stores the release. The aim is to know what is inside your software, where it came from, and whether it has been tampered with. It extends traditional application security outwards into the tooling and vendors around the codebase.
Why it matters
For anyone publishing AI features or content systems, supply chain risk now includes model libraries, SDKs, scraping tools and plugins that few teams inventory properly. A single compromised dependency can expose customer data or inject unwanted code into pages that search engines and AI crawlers then read. It also matters commercially: enterprise buyers and procurement teams increasingly ask for supply chain evidence before signing.
How it works
Teams generate a software bill of materials for each build, scan dependencies for known vulnerabilities and licence issues, pin versions, and sign build artefacts so their provenance can be verified. Build pipelines are locked down with least privilege credentials, short lived tokens and isolated runners. Policies then gate releases, for example blocking a deploy when a critical vulnerability appears in a direct dependency.
When it applies
It applies whenever you ship software or run automated pipelines, including marketing sites, tag managers, headless CMS builds and internal AI tools built on third party packages.
Examples
- A marketing site build fails its deploy gate because an SBOM scan flags a critical flaw in a JavaScript charting library.
- A team signs container images and verifies signatures at deploy time so an unsigned image cannot reach production.
- A brand audits third party scripts on its site and removes two abandoned tracking tags that no longer receive security updates.
How it is measured
- Percentage of builds producing a complete, machine readable SBOM
- Number of direct and transitive dependencies with known critical or high vulnerabilities
- Mean time to remediate a flagged dependency after disclosure
- Share of released artefacts that are signed and provenance verified
Insights on Software supply chain security
Related terms in Enterprise AI
- AI agentsAI agents are software systems that use a language model to plan and carry out multi-step tasks, rather than simply returning a block of text. They can call tools, query APIs, browse websites and write to other systems in pursuit of a goal, with varying degrees of human oversight. The term covers everything from a scripted assistant that books a meeting to a research agent that gathers sources and drafts a report.
- AI chipsAI chips are processors designed or optimised to run machine learning workloads, especially the large matrix operations behind training and inference. The category covers GPUs, tensor and neural processing units, and custom ASICs, usually paired with high-bandwidth memory and fast interconnects. They are also called AI accelerators or AI semiconductors.
- AI drug discoveryAI drug discovery is the use of machine learning and computational models to support the early stages of finding and refining new medicines. Models are applied to tasks such as predicting protein structures, identifying candidate molecules, prioritising targets and estimating properties like toxicity or binding affinity. The aim is to narrow a very large search space before expensive laboratory and clinical work begins.
- AI infrastructureAI infrastructure is the stack of hardware, networking, storage and software needed to train, fine-tune and serve AI models at scale. It spans accelerators such as GPUs, the data centres and power that house them, and the orchestration and serving layers that turn raw compute into working model endpoints. For most marketing teams it is a cost and capacity constraint they consume through APIs rather than something they build.
- AI procurementAI procurement is the process of evaluating, buying and contracting artificial intelligence tools and services, from assistants and content platforms to models accessed through an application programming interface. It covers commercial terms alongside security, data protection, accuracy and integration questions that do not arise with ordinary software. Most organisations run it as a structured review with pilots, stakeholder sign off and defined exit conditions.
- AI securityAI security is the practice of protecting AI systems, their data and the applications built on them from misuse, manipulation and leakage. It covers threats such as prompt injection, data exfiltration through model outputs, unsafe tool use by agents and compromised supply chains. It also covers the controls that keep AI features safe once they are live.
Primary research · August 2026
How ChatGPT Shortlists Software Brands
An audit across 10 categories and 60 buying questions. I recorded what ChatGPT reads, throws away and links to when a buyer asks it which software to buy, and what that decides.
- 60
- Questions asked
- 10
- Software markets
- 2,680
- Results read
- 367
- Links shown
Free download
Get the full report
35 pages · PDF · 536 KB. Enter your details and it downloads straight away.