Beyond the Black Box | AI Supply Chain Security Report

Beyond the Black Box: How AI is Forcing a Rethink of Software Supply Chain

In our survey of 300+ security leaders and practitioners, executives reported high confidence in AI governance, while AppSec and Product Security teams reported more gaps, more friction, and less visibility into what AI is actually running in production.

Teams are investing in transparency. But the reality is messier than the narrative.

Key Findings:

• 60% of respondents create SBOMs, but more than 50% of organizations aren't consuming or managing their SBOMs in practice.
• 63% of survey participants report their organizations have shadow AI, indicating widespread unmanaged usage.
• 45.7% of global respondents have experienced legal risks due to AI model licensing or provenance.
• 57.8% of AppSec respondents share that AI is governed separately from the software supply chain.

Progress is real. Alignment is not.

This report highlights a real discrepancy between security leaders and the practitioners on the ground when it comes to AI governance and software supply chain security.