Research area · Supply Chain Security
From the bill of materials to the coding agent: making supply chains verifiable
Today, software, models, and services come from many hands. Vami Research examines how this supply chain can be made verifiable: with SBOM, VEX, and SLSA provenance, with AI-SBOMs for models and training data, with a bill of materials for coding agents, and with assessments of service providers based on the EBA Guidelines and the catalogs of the Cloud Security Alliance.
- SBOM & VEX
- AI-SBOM
- SLSA
- Slopsquatting
- Coding agents
- Third-party risk
- CSA CAIQ & AICM
- Deep Dives
- 6
- Whitepapers
- 3
- Solutions
- 1
The supply chain no longer ends at the package manager
Software is made up of third-party libraries, frameworks, and services. Since Log4Shell, if not before, it has been clear: without component transparency, there is no way to tell whether and where a new vulnerability hits. The Cyber Resilience Act makes the software bill of materials mandatory for products with digital elements — as part of the technical documentation, covering at least the top-level dependencies. The reporting obligations have applied since September 11, 2026, and the main obligations apply from December 11, 2027.
AI adds new links. Models, weights, and training data determine how an AI system behaves, yet they do not appear in a classic SBOM. Attacks on them are documented: in February 2024, JFrog found around 100 malicious models on Hugging Face whose payload executes when the model is loaded. Coding agents extend the chain with MCP servers, skills, and editor extensions — on October 29, 2026, a tampered Claude Code extension in the Cursor marketplace showed how vulnerable this distribution channel is as well.
On top of this come service providers as well as cloud and AI providers. With NIS2 and DORA, assessing direct suppliers has become mandatory. The EBA/GL/2026/09 Guidelines, published on September 18, 2026, create a framework for non-ICT services for credit institutions, investment firms, payment institutions, and other financial entities; their date of application has not yet been set. Vami Research combines technical evidence such as SBOM, VEX, and provenance with standardized assessments based on the CSA CAIQ and the AI Controls Matrix.
Open questions in practice
- 01
How does an SBOM go from a document to an early warning system for new vulnerabilities?
Our approach
We rely on generation at build time, for example with cdxgen or Syft, versioned per release and ideally signed. After that, what counts is continuous matching against NVD, OSV, and GitHub Advisories; VEX records whether a vulnerable component actually affects the product. VamiAppSec monitors every shipped SBOM for actively exploited vulnerabilities, using sources such as CISA KEV, and prioritizes with EPSS.
- 02
What belongs in the bill of materials of an AI system whose behavior shifts without any code change?
Our approach
Alongside libraries, we inventory models, weights, and training and evaluation data, including their origin. Since version 1.5, CycloneDX has listed models and data as components in their own right, SPDX 3.0 offers an AI profile and a Dataset profile, and model cards become machine-readable. A maintained AI-SBOM provides the data foundation for the documentation obligations under the Cyber Resilience Act and the AI Act.
- 03
How can coding agents be introduced without losing control over the supply chain?
Our approach
Like any other change: new dependencies and lockfile changes need a named approval in the dependency review, enforced through an internal registry proxy with an allowlist. For financial entities under the full DORA framework, the regulatory technical standards require separating the approval and implementation of changes — an agent that merges its own pull requests does not fit with this.
- 04
How do organizations manage third-party risk across ICT, non-ICT, cloud, and AI services within one framework?
Our approach
Through a lifecycle: identify third parties, classify them by criticality, assess their security practices, and secure them contractually — from procurement to exit. We assess AI services against the CSA's AI Controls Matrix, which addresses model poisoning and prompt injection, among other things. The EBA Guidelines explicitly expect financial entities to take a holistic approach across ICT and non-ICT.
Key takeaways
- 01
An SBOM only becomes effective in operation
Generating a file once is not yet SBOM management. The bill of materials only delivers its value through continuous matching against vulnerability data: then, when a new CVE appears, you can say immediately which products contain affected components. VEX adds the manufacturer's statement to the SBOM on whether a vulnerable component actually affects the product.
Source: SBOM Management
- 02
AI models can change without any code moving
The behavior of an AI system depends on the model, weights, and training data — artifacts that a classic SBOM does not capture. Retraining or fine-tuning can fundamentally change a model while code and package versions stay the same. An AI-SBOM based on CycloneDX ML-BOM or SPDX 3.0 makes these components assessable.
Source: AI-SBOM
- 03
An agent inventory with names alone goes stale silently
Coding agents bring their own links into the supply chain: tool, model and provider, MCP servers, skills, and rule files. Remote MCP servers can change without the organization noticing. We therefore recommend a machine-readable agent bill of materials with a version or hash for MCP servers and skills — maintained alongside the SBOM for each release.
Source: Slopsquatting & coding agents
- 04
Supplier assessment is a process, not a questionnaire
A completed questionnaire describes a provider as of a single reference date. The assessment only becomes robust as an ongoing process: classify criticality, evaluate CAIQ or AICM responses as well as certificates and audit reports, and tie reassessments to defined triggers — for critical functions, supplemented by a concentration analysis and an exit strategy under DORA.
Source: Supply Chain Security
How we work
Vami Research views the supply chain as a chain of evidence: what is inside an artifact, how it was built, who supplies it, and which agents are allowed to change it.
SBOM at build time
Generate bills of materials in CycloneDX or SPDX directly in the build, version them per release, and store them with the artifacts — for example with cdxgen or Syft.
VEX and vulnerability matching
Continuous matching against NVD, OSV, and GitHub Advisories; VEX and CSAF documents record which findings actually affect a product.
AI-SBOM
Capture models, weights, and datasets as components: CycloneDX ML-BOM, SPDX 3.0 profiles for AI and datasets, machine-readable model cards.
SLSA provenance
Provenance records as in-toto attestations, signed and verified before deployment; built out along levels L1 to L3 of the Build Track.
Agent bill of materials
For each coding agent, record tool and version, model and provider, MCP servers, skills, and rule files in machine-readable form — MCP servers and skills with a version or hash.
Catalog-based provider assessment
CSA CCM and CAIQ for cloud providers, the AI Controls Matrix for AI services — evaluated together with available certificates and audit reports.
How to get started
- 1Build an inventoryRecord components, models, extensions, and service providers and classify them by criticality — as the basis for every assessment.
- 2Embed controlsSBOM and provenance in the build, approvals for new dependencies and extensions, contractual obligations for suppliers and providers.
- 3Monitor continuouslyMatch shipped SBOMs against CISA KEV and prioritize with EPSS, reassess providers on defined triggers, and maintain evidence for the CRA, NIS2, and DORA.
Deep dives, whitepapers, and analyses
Deep Dives 6
Whitepapers 3
From research area to implementation
Related research areas
Want to review your supply chain, from the SBOM to the coding agent?
Together with you, we assess your SBOM process, AI components, agent policies, and critical service providers and map the results to the CRA, NIS2, and DORA. Contact us for a no-obligation initial consultation.