AIBOM in Action: Lessons from the First AI Supply Chain Audits

Summary

RSAC Podcast Episode Summary

Episode Title: AIBOM in Action: Lessons from the First AI Supply Chain Audits
Release Date: August 11, 2026
Host(s): Tatiana Sanchez, Casey Zerkis
Guest: Nosheen Begum (CSSP, Compliance Officer, AI Governance & Supply Chain Security Expert)

---

Episode Overview

This episode explores the rapidly evolving landscape of AI-enabled supply chain attacks and the growing necessity of the AI Bill of Materials (AI BOM) as a defense mechanism. Guest expert Nosheen Begum breaks down the concept of AI BOM, shares firsthand lessons from conducting early audits, highlights unexpected vulnerabilities (such as "shadow AI"), and gives practical, actionable advice for organizations just starting their AI BOM journey. The discussion also addresses the accelerating pace of AI-specific regulation and provides strategic guidance for organizations seeking to anticipate compliance requirements and proactively secure their AI supply chains.

---

Key Discussion Points & Insights

1. AI BOM Explained: Foundations and Necessity

• SBOM Analogy: Nosheen likens the AI BOM to the well-known Software Bill of Materials, describing it as an "ingredient list"—but for AI systems.
  • “The easiest way to understand AI BOM is through an analogy. Most security professionals already know the SBOM software bill of materials...AI BOM does the same thing, but for AI systems. Specifically, it inventories every AI component in your environment.” (Nosheen Begum, 04:19)
• Key Elements Captured: The AI BOM tracks:
  • All AI models in use
  • Their sources and creators
  • Training data details
  • Framework dependencies
  • External APIs or fine-tuning layers
• Unique Attack Surface: Unlike code, AI risk is often embedded in training data and model weights, meaning vulnerabilities may not appear in code reviews.
  • “With AI, the risk lives in the training data, the model weights, the fine-tuning process...Without an AI BOM, you cannot even begin to ask the right question about your AI provenance.” (Nosheen Begum, 05:36)
• Critical Liability: The lack of visibility into AI components creates a dangerous gap—"a critical liability"—making the AI BOM “necessary” for modern supply chain protection.

---

2. Insights from the First AI Supply Chain Audits

• Shadow AI Revealed:
  • The most “genuinely surprising” audit finding was the widespread presence of uncontrolled or undocumented AI usage.
  • Organizations believed they were using only “two to three AI tools,” but audits “found dozens” of undocumented instances—everything from ChatGPT, GitHub Copilot, Grammarly, to various AI plugins in SaaS tools. None of these were reviewed by security.
• Invisible Attack Surface:
  • This “shadow AI problem” massively expands the attack surface, creating risk blind spots.
  • Attackers are exploiting this invisibility with tactics such as:
    • Phantom squatting: Registering fake domains that large language models (LLMs) might hallucinate and reference, tricking users into unsafe downloads.
    • Package poisoning: Manipulating open-source package repositories to deceive developers into installing malicious components.
• AI Supply Chain Risk is Immediate:
  • “AI supply chain risk is not a future problem, it is a current operation problem.” (Nosheen Begum, 08:42)
  • The most at-risk are organizations that adopted AI rapidly without governance, not those who delayed adoption.

---

3. Regulations & Compliance: The Fast-Closing Gap

• AI BOM to Become Mandatory:
  • AI BOM is moving from “best practice” to “compliance requirement.”
  • Nosheen highlights several regulatory frameworks pushing this shift:
    • EU AI Act: Enforces transparency for high-risk AI systems; mandates clear documentation (AI BOM by implication).
    • NIST AI Risk Management Framework: Calls for documentation of AI components across the supply chain.
    • FDA Guidance (Healthcare): Focusing on AI and ML in medical devices and related supply chain transparency.
  • “The regulatory landscape is moving faster than most organizations realize and the convergence point is clear. The AI BOM documentation because it is going to become a compliance requirement, not just a best practice.” (Nosheen Begum, 10:32)
• Where AI BOM is Headed:
  • Standardization: Expect industry-wide norms for documenting AI provenance.
  • Automation: Emergence of tools to continuously scan and alert on new AI model usage, similar to software dependency scanners.

---

4. Practical Steps to AI BOM Implementation

• Start Simple—Survey and Discover:
  • Immediate action: Ask internal teams what AI tools they actually use—not just the ones officially approved.
    • “Ask your people what AI tools they can actually using and what is approved, what is actually in use. Send a survey, hold a team meeting...you will be surprised and probably alarmed by what you find.” (Nosheen Begum, 13:06)
• The Four Essential Inventory Questions (for each discovered AI tool):
  1. Who built this model?
  2. What data was it trained on?
  3. What does it have access to in your environment?
  4. What happens to the data sent to it?
• Make It Living:
  • Build and maintain a “living document” that is regularly updated, includes ownership, and flags new or changed components during review cycles.
• Procurement Baseline:
  • Before adopting new AI tools, require vendors/suppliers to answer your standardized AI BOM questions.
    • “Following this process, having a proper documentation and AI governance policy in place, this is how you stop the shadow AI problem before it starts.” (Nosheen Begum, 15:50)

---

Notable Quotes & Memorable Moments

• On the shocking scope of Shadow AI:

  • “Organizations would tell me we have approved two to three AI tools and then when we did a real inventory we could find dozens employees using ChatGPT, GitHub Copilot, Grammarly, AI plugins in their browsers…None of it is documented, none of it is in the scope of any security review. That is the invisible attack surface.”
    (Nosheen Begum, 07:26)

• On the urgency of AI BOM:

  • “AI supply chain risk is not a future problem, it is a current operation problem…The organizations being hit are not the ones who ignored AI entirely, but the ones who adopted it quickly without building the governance layers.”
    (Nosheen Begum, 08:42)

• On practical first steps:

  • “Ask your developers in your organization, your analyst, your HR team, your finance team. You will be surprised and probably alarmed by what you find. The discovery steps is zero and your AI BOM foundation starts over there.”
    (Nosheen Begum, 13:15)

• On regulatory readiness:

  • “The regulatory landscape is moving faster than most organizations realize and the convergence point is clear. The AI BOM documentation because it is going to become a compliance requirement, not just a best practice.”
    (Nosheen Begum, 10:32)

---

Timestamps for Important Segments

• AI BOM Defined & Importance: 04:19 – 06:52
• Findings from Early Audits (Shadow AI, Attack Types): 07:20 – 10:12
• Regulatory Landscape & Future Directions: 10:32 – 12:44
• Practical AI BOM Implementation Steps: 13:06 – 15:57

---

Tone and Language

• Conversational, direct, and practical—designed to demystify technical topics for security professionals at any stage.
• Frequent use of analogies (“ingredient list”), real-world audit anecdotes, and actionable advice for listeners.

---

Conclusion

This episode makes a compelling case that AI BOM is no longer optional—it is rapidly becoming essential to both security and compliance in organizations leveraging AI. Listeners walk away with a clear understanding of the concept, the immediate operational risks of shadow AI, and a concrete, three-step plan to begin closing the visibility and governance gap—before regulators, attackers, or both force their hand.

---

(Compiled by RSAC Podcast Summarizer)

Transcript

[Nosheen Begum]

Welcome to the RSAC cyberatthettop podcast where security leaders across industries share the strategies, hard lessons and real experiences shaping modern cybersecurity and AI insights are grounded in community and built for every level of profession.

[Tatiana Sanchez]

Hello listeners, welcome to this edition of our RSAC Cyber Security of the Top podcast series. Thank you for tuning in. I'm Tatiana Sanchez.

[Casey Zerkis]

And I'm Casey Zerkis and we are

[Tatiana Sanchez]

your RSAC podcast hosts. Casey, what are we going to discuss today?

[Casey Zerkis]

Well, AI enabled supply chain attacks are exploding in scale and sophistication. And according to JFrog's 2026 software supply chain Security State of the Union report, malicious packages surged a whopping 451% year over year to more than 171,000 unique instances. This really makes last year the most dangerous on record for developers, which is why it's so important for organizations to understand what an AI bomb is. It's an AI bill of materials and it helps defend against these kinds of supply chain attacks. So we're excited to be joined today by Noucheen Begum, who will break down what AI bomb is and why it's important especially to supply chain in the era of AI. We'll get into the key findings and unexpected insights uncovered in the first wave of AI bomb audits, what practical frameworks organizations can start using today, and what the future of regulation and oversight looks like from here.

[Tatiana Sanchez]

And before we get started, we want to remind our listeners that here at RSAC we host podcasts twice a month and we encourage you to subscribe, rate and review us on your preferred podcast app so that you can be notified when new tracks are posted. And now we would like to ask our guest to formally introduce herself before she dives in.

[Nosheen Begum]

Nouchin, thank you so much for the wonderful introduction. It's an honor to be here on RSAC's Cyber at the Top Cities. I am Nosheen Vegam. I am a CSSP with 10 years of experience in cybersecurity spanning GRC, security, operations, incident response, Vulnerability management. My career has taken me through wonderful companies, IBM, SecureWorks, Credit Suisse, UBS and Accenture. And most recently I have stepped into a compliance officer role at a healthcare SaaS company in the pharmaceutical supply chain space where AI governance and supply chain security intersect directly with my day to day work. Beyond my day job, I am deeply embedded in the Wisconsin cybersecurity community, which I'm mostly proud of doing that I serve as a Vice President of Women in Cyber Security Wisconsin Chapter and I'm on the boards of isaca, Milwaukee and ISE to Wisconsin chapters AI Security, especially AI bill of materials and what I call defending the AI supply chain has become a major focus of my research and speaking work over the past.

[Tatiana Sanchez]

Yeah, thank you so much nouching. Thank you for being here today. And we have seen an explosion of BOMs at RSHC 2026 conference, especially since software bill of materials known as SBOM took hold. We've been seeing people talk about seed bomb, HBOM and now AI bomb. So Nishin, for those who may not be familiar with the term AI bomb, can you unpack what an AI bill of materials actually is? And why is it becoming so critical for AI supply chain security?

[Nosheen Begum]

Absolutely. And you have taken a few critical words, AI bomb, H bomb, S bomb. I would like to start in the easiest way, explaining and going in depth how and what critical terms AI BOM would be included in the organization. So the easiest way to understand AI BOM is through an analogy. Most security professionals already know the SBOM software bill of materials. And SBOM is essentially an ingredient list of software. It tells you every open source library, every dependency, every component inside an application. So when a vulnerability like lock 4 shell hits, you can immediately answer are we affected by without guessing. And now AI BOM does the same thing, but for AI system. Specifically, it inventories every AI component in your environment. The models you are using, who trained them, what data they are trained on, the frameworks they depend on, the API they call the fine tuning layers applied on top. It answers the questions like what is actually inside the AI and where did it come from? These are very critical basic foundation things every organization must focus on. And the reason this is becoming a cornerstone of supply chain security is straightforward because AI systems have a fundamentally different attack surface than traditional software which we have seen in SBoM. With code, you can audit the logic. With AI, the risk lives in the training data, the model weights the fine tuning process. As attacker can poison a model at the data layer and you would never catch it in the code review. Without an AI bomb, you cannot even begin to ask the right question about your AI provenance. So that is the visibility gap is a critical liability, which is why AI bomb is necessary.

[Casey Zerkis]

So AI supply chain attacks are definitely on the rise, right? And we've seen everything from phantom squatting where attackers register the fake domains LLMs hallucinate in order to intercept AI generated traffic, to even AI package poisoning attacks. So what key findings and unexpected insights have come out of your early AI supply chain audits? And what does this tell us.

[Nosheen Begum]

It's a great question. This question actually gets at something that genuinely surprised me when I started doing this work. The gap between what organizations think their AI exposure looks like and what it actually looks like. So one of the single biggest finding across early AI bomb audits is what I call the shadow AI problem. For example, organizations would tell me we have approved two to three AI tools and then when we did a real inventory we could find Dozens employees using ChatGPT, GitHub, Copilot, Grammarly, AI plugins in their browsers, which are just an example. There are many more AI features embedded in the software as service tools they already subscribed to. None of it is documented, none of it is in the scope of any security review. That is the invisible attack surface which we have spoke in our first question. And what phantom squatting and package poisoning tell us is that attackers are now specifically targeting that attack. Invisibility. When an LLM hallucinates a package name and they do that regularly, a developer installs it without verifying that is an AI bomb failure without verification and installation is a vulnerability in any organization. I would say insights I take from this is that AI supply chain risk is not a future problem, it is a current operation problem. The organizations being hit are not the ones who ignored AI entirely, but the ones who adopted it quickly without building the governance layers. So the AI bomb gives you that governance layer. It forces the question can I account for every AI component in my environment, trace its origin and verify it has been tampered with? Answer to this question gives the visibility of your attack surface in your organization.

[Tatiana Sanchez]

Thank you Nosheen. And as we know AI is increasing and attackers are using it, which we'll see more regulations around that. So can you tell our listeners what emerging regulations should organizations have on their radar regarding AI bombs? And where do you see AI bomb heading next in the AI supply chain oversight?

[Nosheen Begum]

The regulatory landscape is moving faster than most organizations realize and the convergence point is clear. The AI bomb documentation because it is going to become a compliance requirement, not just a best practice. Here's what is on the radar right now. I can specify few acts which have been implemented. The EU AI act is already in force for high risk AI systems and it explicitly requires transparency about the data and systems used in the developed AI that is AI bomb language, even if it doesn't use the term. And also we have seen NIST has published the AI Risk Management framework already which calls for documentation of AI components and supply chain dependency through the AI life cycle. And if I Talk about specifically in healthcare sector. The FDA is developing a guidance on AI and machine learning in medical device which is directly related to a supply chain beyond regulation. I see AI BOM heading in two directions simultaneously. The first one is standardization and the second direction is automation. If I talk about the second direction more specifically, the same way SEA tools can code repositories for vulnerable dependencies. We have seen AI governance tools that continuously monitoring your AI component inventory and alert models now. So the organizations are building this muscle now and they are coming towards this regulation.

[Casey Zerkis]

So nouching, you mentioned earlier that AI BOM is becoming a cornerstone of AI supply chain security. I'm just curious to know where should an organization actually start? What are the first concrete steps to begin implementing a strong AI bomb today?

[Nosheen Begum]

I think people talk about AI bill of materials and immediately assume it requires a massive framework before they can do anything useful. But actually it is not. The first step is simple. Ask your people what AI tools they can actually using and what is approved, what is actually in use. Send a survey, hold a team meeting, ask your developers in your organization, your analyst, your HR team, your finance team. You will be surprised and probably alarmed by what you find. The discovery steps is zero and your AI bomb foundation starts over there. From that point of discovery, each tool you discover, you want to answer four questions. First is who builds this model? What data was it trained on? What does it have access to in our environment? What input are we providing? What happens to the data we send to it? Answering to these questions do form a backbone of an AI component inventory. After doing this survey and getting answers to these questions, step two is building that inventory into a living document, having a policy documented, created. According to the survey, your AI BOM needs to be maintained the same way a software dependency list is maintained with stakeholders, owners and the process of flagging new addition in every review cycles. And I would say the third step is every organization is skipping most often establishing a minimum baseline for AI procurement. Before any new AI tool gets approved. We need to have a vendor communication to our questions and having the answers to the four basic questions we have set in our organization in the same way to our vendor. Following this process, having a proper documentation and AI governance policy in place, this is how you stop the shadow AI problem before it starts.

[Casey Zerkis]

I think that's probably one of the greatest challenges for most organizations is that AI procurement process and understanding is using what AI tools across the whole of the company. So that's great guidance nouching. Thank you so much, really appreciate you being here. With us today listeners. Thank you for tuning in. Please keep the conversation going in our RSAC membership platform by visiting onersac.commembership and be sure to check onersac.com for new content posted year round.

[Nosheen Begum]

Until next time, Sam.