An Uluhlu lwezinto ze-AI yikhathalogu ehlaziywa rhoqo yazo zonke izinto ze-AI ezisebenza kumbutho wakho — iimodeli, ii-endpoints ezisebenza nge-AI, iiseti zedatha, abancedisi beekhowudi ze-AI, iiseva ze-MCP kunye nokuxhomekeka kwe-AI — kunye nobudlelwane, iingozi kunye nabanini ezibadibanisayo. Kwimeko yokhuseleko oku akunanto yakwenza nolawulo lwendawo yokugcina impahla okanye isitokhwe; apha, "Uluhlu lwezinto ze-AI" kuthetha nje ukwazi ukuba yeyiphi i-AI oyisebenzisayo, apho ihlala khona, kunye nokuba ingafikelela phi.
Njengoko i-AI isasazeka kuzo zonke izigaba zophuhliso lwesoftware, ukusuka ekudalweni kwekhowudi kwi-IDE ukuya kwiiarhente ezizimeleyo ezisebenza ngaphakathi CI/CD pipelines, umbuzo awusekho kukuba ingaba i-AI ikhona na kwindawo okuyo. Kukuba ungayibona na. Esi sikhokelo sichaza ukuba yintoni na i-AI inventory, indlela enxulumene ngayo ne-AI I-AI-BOM kunye SBOM, ngoba isithunzi AI iye yaba yingxaki yokhuseleko, kwaye indlela le nkqubo ehambelana ngayo ne Umthetho we-EU AI, I-NIST AI RMF kwaye ISO / IEC 42001.
Ukuthatha okuphambili
- I-inventory ye-AI ikhathaloga yonke imodeli, iseti yedatha, iarhente, iseva ye-MCP kunye nesixhobo sokubhala ikhowudi ye-AI kuyo yonke isoftware yakho, kungekuphela nje ezo zivunyiweyo yi-IT.
- Isithunzi AI, i-AI eyamkelwe ngaphandle kolawulo, ngoku yinto eqhelekileyo, ayisiyonto ingaqhelekanga: kuphando olunye lwango-2026 lweenkokheli zokhuseleko, kuphela I-19% yemibutho ixele ukuba iyazi ngokupheleleyo indawo kunye nendlela i-AI esetyenziswa ngayo.
- An I-AI-BOM (uMthetho weZixhobo ze-AI) yimveliso elungele uphicotho-zincwadi ye-AI: umlandeli wexesha le-AI kwi- SBOM.
- Umthetho uyafika. UMthetho we-EU AI, i-NIST AI RMF kunye ne-ISO/IEC 42001 zonke zifuna ukuba wazi ukuba yeyiphi i-AI oyisebenzisayo.
- Uluhlu lwezinto luqala nje kuphela; ixabiso livela ekufumaneni umngcipheko kwaye lisebenze kwinani elincinci leeasethi ezibalulekileyo ngokwenene.
Yintoni i-inventory ye-AI?
Uluhlu lwe-AI luqheliselo lokufumanisa, ukukhathaloga kunye nokubeka esweni rhoqo yonke impahla ye-AI esebenza kumjikelo wobomi bakho bophuhliso lwesoftware, kunye nemingcipheko enxulumene nayo nganye. Uluhlu olupheleleyo luphendula imibuzo emithathu kwimpahla nganye: yintoni, isebenza phi, kwaye inokufikelela phi?
Loo mmandla ubanzi kunokuba uninzi lwamaqela lulindele. Uluhlu olunentsingiselo lwe-AI lufanele lugubungele:
- imifuziselo: yonke imodeli yolwimi olukhulu kunye nemodeli yesiseko esetyenziswa kuphuhliso nakwimveliso, kunye nenguqulelo, indawo kunye nokuzithemba kokufumanisa.
- Datasets: idatha yoqeqesho, iiseti zedatha zokufunyanwa kunye neendawo zokugcina iivektha, kubandakanya ukuchatshazelwa kumxholo onetyhefu kunye nokuvuza kwedatha.
- agents: iinkqubo ezizimeleyo ezithatha amanyathelo kwindawo okuyo, njengokuvula pull requests, ukufaka izinto ezixhomekeke kuzo, okanye ukuthintela iziseko zophuhliso.
- abancedisi be-MCP: INkqubo yoMxholo woMfanekiso iiseva ezidibanisa abancedisi be-AI kwizixhobo zangaphandle, ii-API kunye nemithombo yedatha.
- Izixhobo kunye nabancedisi bokubhala iikhowudi ze-AI: ii-copilots kunye nokuhlanganiswa kwe-IDE okuvelisa ikhowudi, cebisa ukuxhomekeka kwaye usebenzisane neendawo zokugcina izinto.
- Izakhelo ze-AI: I-LangChain, i-LangGraph, ii-arhente zeeseva kunye nezinye iileya zokudibanisa ezidibanisa iimodeli kwizixhobo kunye nedatha.
- Ubudlelwane phakathi kwezinto ezisetyenziswayo: unxibelelwano phakathi kweemodeli, iiarhente, iiseva, iiseti zedatha kunye neemfihlo ezidibene nazo. Igrafu yobudlelwane yenza umngcipheko ubonakale kwimeko, kungekhona njengoluhlu oluthe tyaba.
Uluhlu lwempahla ye-AI ngokuchasene noluhlu lweempahla ze-AI ngokuchasene ne-AI-BOM, kunye nendlela ezahluke ngayo kwi- SBOM
La magama asetyenziswa ngokukhululekileyo, ngoko ke kuyanceda ukubacise. "Uluhlu lwempahla ye-AI" kunye "noluhlu lweempahla ze-AI" zichaza into efanayo: ikhathalogu ephilayo yeempahla ze-AI kunye nemingcipheko yazo. I-AI-BOM yinto ethunyelwa kwamanye amazwe eveliswa yimpahla: ibhili yezinto ezifundeka ngomatshini onokuzinika umphicothi-zincwadi okanye umphicothi-zincwadi enterprise umthengi.
Eyona ndlela icocekileyo yokuqonda i-AI-BOM kukufana ne- SBOM:
Njengoko i-AI ingena kuyo yonke indawo SDLC, i-AI-BOM iya isiba sisiseko njenge SBOM, kwaye iinkokheli zokhuseleko ziya kwamkela izicelo ezivela kubahloli bee-akhawunti kunye enterprise amaqela okuthenga kanye le nto yenziweyo.
Kutheni isitokhwe se-AI sibalulekile ngoku
Amandla amathathu aguqule uluhlu lwe-AI ukusuka kwinto entle ukuba nayo lwaba yinto ephambili.
- Okokuqala, i-AI ibhala ikhowudi engakhuselekanga kwinqanaba elithile. Uphando oluzimeleyo luhlala lufumanisa ukuba uninzi lweekhowudi ezenziwe yi-AI zihamba nobuthathaka. Uphononongo lokuqala lwe-NYU/Copilot lukaPearce et al. lufumanise malunga nokuba yintoni na. Ama-40% eenkqubo ezenziweyo ayenobuthathaka bokhuseleko, kunye neendawo zovavanyo ezinkulu zamva nje ngendlela efanayo: Uhlalutyo lukaVeracode luka-2025 kwiimodeli ezingaphezu kwe-100 lufunyenwe kuphela I-55% yekhowudi eyenziwe yi-AI yayikhuselekileUkuba awazi ukuba zeziphi ii-assistants ezivelisa ikhowudi yakho pipelines, awunakuyilawula loo mngcipheko.
- Okwesibini, uthotho lobonelelo lwesoftware luye lwaba yindawo yokuhlasela ye-AI. Ngo September 2025, Shai Hulud, i-npm worm yokuqala ezikhulisa ngokwayo, yaguqula oomatshini bophuhliso baba yindlela yokusasaza, isasazeka kwiiphakheji ezingamakhulu. NgoMatshi 2026, abahlaseli babandakanyeka kwi-intanethi. axios, iphakheji ene- Ukukhuphela kwe-100 yezigidi ngeveki, ipapasha iinguqulelo ezinetyhefu eziwise itrojan yokufikelela kude. Uhlaselo olunje lufika kanye kumaleko phakathi kwe-AppSec yendabuko kunye nezixhobo zokugqibela: umaleko i-AI inventory eyakhelwe ukukhanyisa.
- Okwesithathu, iimfihlo kunye neziqinisekiso ziyavuza nge-AI. Ingxelo ye-State of Secrets ka-GitGuardian ka-2026 ibike ukuba Ukuvuza kweemfihlo zenkonzo ye-AI kunyuke ngama-81% unyaka nonyaka, kwaye loo nto incediswa yi-AI commits leak secrets malunga nesibini sereyithi yesiseko. Yonke imodeli engabhalwanga, iarhente okanye iseva ye-MCP yindlela enokwenzeka yokufumana isiqinisekiso.
I-AppSec yendabuko ima kwindawo yokugcina izinto kwaye ayiqondi ukuba yintoni imodeli. Izixhobo ze-Endpoint zijonga inkqubo yokusebenza kodwa aziqondi iipakeji, iiseva ze-MCP okanye abancedisi be-AI. Umsantsa phakathi kwazo kulapho umngcipheko we-AI uqokelelana khona, kwaye uluhlu lwempahla linyathelo lokuqala lokuyivala.
Apho i-AI ifihla khona: Isithunzi se-AI ngaphesheya kwe- SDLC
Isithunzi AI Ngaba kukho nayiphi na inkqubo ye-AI eyamkelweyo ngaphandle kwemvume okanye ulawulo olusemthethweni: i-copilot eyenziwe ngumphuhlisi kwiveki ephelileyo, iseva ye-MCP isebenza kwi-laptop, imodeli itsalwe ngqo kwi-public hub yaya kwiprojekthi esecaleni. Ayisiyongxaki. Kuphando luka-2026 lweenkokheli zokhuseleko ezingaphezu kwama-400, kuphela I-19% ixele ukuba iyabonakala ngokupheleleyo indawo kunye nendlela i-AI esetyenziswa ngayo kulo lonke umbutho wabo, ngelixa uninzi lwabo belusele lusebenzisa okanye luvavanya abancedisi beekhowudi ze-AI.
Eyona mthunzi we-AI onzima ukuyifumana yi-AI engaphakathi komjikelo wobomi besoftware, kuba ayifane ibonakale kwi-cloud console:
- Iimodeli kunye neelayibrari ze-AI zitsalelwe kwiindawo zokugcina izinto njengezinto ezixhomekeke kuzo.
- Abancedisi bokubhala iikhowudi ze-AI abalungiselelwe ngomphuhlisi ngamnye, ngokwe-IDE nganye.
- Iiseva ze-MCP kunye neefayile zolawulo ezisebenza kwindawo yakho kwii-endpoints zabaphuhlisi.
- Imisebenzi ye-arhente ivula ngokuthula pull requests okanye ukufaka iipakethe.
Yiyo loo nto ukufunyanwa kwe-cloud kuphela kungonelanga. Uluhlu olupheleleyo lwe-AI kufuneka lufikelele kwikhowudi kwaye lwakhe iindawo (ilaptop yomphuhlisi, indawo yokugcina idatha, pipeline), kungekuphela nje ilifu lemveliso.
Yintoni efanele i-AI-BOM
I-AI-BOM elungele uphicotho-zincwadi iguqula uluhlu lwakho lwezinto lube yinto onokuyingqina. Ubuncinane, kufuneka iquke:
- Zonke izinto ze-AI: iimodeli, iiseti zedatha, iiarhente, iiseva ze-MCP, izixhobo zokubhala ikhowudi ze-AI.
- Uhlobo lweasethi, indawo kunye nokuzithemba kokufunyanwa kwayo nganye.
- Imvelaphi kunye nokuxhomekeka (apho imodeli okanye icandelo livela khona).
- Inqanaba lomngcipheko ngempahla nganye, ngokusekelwe kwiivektha zohlaselo ezithile ze-AI.
- Umgaqo-nkqubo woMthetho we-EU AI, i-NIST AI RMF kunye ne-ISO/IEC 42001.
- Ifomathi enokuthunyelelwa kwamanye amazwe, efundeka ngomatshini kubahloli beengxelo kunye nabathengi.
Imibutho enokuvelisa i-AI-BOM xa ifunwa iya kuba nethuba lokuthobela imithetho kunye nokuthembana njengoko izibophelelo zokuhlolwa kwe-AI zikhula.
Uluhlu lwezinto ze-AI kunye nokuthobela imithetho: UMthetho we-EU AI, i-NIST AI RMF kunye ne-ISO/IEC 42001
Akukho nanye kwezi framework ziphambili ebiza "i-AI inventory" njengento yomgca, kodwa nganye ayinakukwazi ukuyifezekisa ngaphandle kwayo. Awunakubhala phantsi, uhlele okanye ulawule iinkqubo ze-AI ongenakuzibona.
Inqaku malunga nexesha: ukuqaliswa koMthetho we-EU AI kuhlaziywe sisivumelwano sikaMeyi 2026 esithi “Digital Omnibus”, esathi sahlehlisa uninzi lwezibophelelo ezinobungozi obukhulu ukuya kuDisemba 2027, ngelixa sigcina iimbali ezininzi ze-2 Agasti 2026 ziphila (imisebenzi yokucaca, amandla esohlwayo se-GPAI). Phatha imihla echanekileyo njengento eshukumayo kwaye uqinisekise ngokuchasene nemithombo ephambili ye-EU. Kodwa indlela yokuhamba icacile, kwaye uluhlu lwezinto luyimfuneko kuyo yonke loo nto.
Indlela yokwakha nokugcina uluhlu lwe-AI
Ukwakha uluhlu lwezinto akupheleli nje ekuhlolweni kube kanye kodwa kuxhomekeke ekusekeni inkqubo eqhubekayo, kuba iiasethi ze-AI zitshintsha rhoqo: kwamkelwa iimodeli ezintsha, kuthunyelwa iiarhente ezintsha, kulungiswa iiseva ezintsha ze-MCP, rhoqo ngaphandle kwemvume.
Indlela esebenzayo:
- Fumanisa ngokuzenzekelayo kwikhowudi, ulwakhiwo kunye nelifu. Iispredishithi ezenziwe ngesandla ziyaphela kwisithuba seentsuku ezimbalwa. Ukufumanisa kufuneka kuqhubeke kwaye kufikelele kwi SDLC, kungekuphela nje ixesha lokusebenza.
- Hlela kwaye ubhale ulwalamano ngokweemfuno zakho. Uhlobo lwerekhodi, indawo, imvelaphi, kwaye, ngokubalulekileyo, indlela impahla nganye enxibelelana ngayo nezinye kunye neemfihlo.
- Umngcipheko wamanqaku ngokwemeko. Uluhlu oluthe tyaba lwezinto ezifunyenweyo ezingamakhulu aluncedi mntu; lubeka phambili oko kufikelelekayo, okunokuxhaphazwa nokubalulekileyo kwishishini.
- Nika ubunini. Yonke impahla ifuna umnini onoxanduva.
- Yigcine iphila kwaye ikwazi ukuthunyelelwa kwamanye amazwe. Yigcine njengempahla eqhubekayo enokuvelisa i-AI-BOM xa ifuneka.
Yintoni ekufuneka uyijonge kwisoftware ye-AI inventory
Ukuba uvavanya izixhobo, ezi zizakhono ezahlula isoftware yokwenyani ye-AI kuluhlu olungaguqukiyo:
- Uyaqonda iintlobo zeeasethi ezithile ze-AI (iimodeli, iiarhente, iiseva ze-MCP, iiseti zedatha), kungekuphela nje iipakeji kunye neelayibrari.
- Ifikelela kwi SDLC, ndifumanisa i-AI kwikhowudi nakwiindawo zokugqibela zabaphuhlisi, kungekuphela nje kwilifu.
- Ubudlelwane beemephu, kungekuphela nje kwezinto ezisetyenziswa ngumntu ngamnye, ngoko ke umngcipheko uyabonakala kwimeko leyo.
- Umngcipheko wamanqaku kwiivektha zohlaselo ezithile ze-AI (ukufakwa inaliti ngokukhawuleza, i-MCP engakhuselekanga, ukuzimela okugqithisileyo), kungekuphela nje ubukhali be-CVE.
- Ibaleka ngokuqhubekayo, ukubamba i-AI entsha njengoko ibonakala.
- Ivelisa i-AI-BOM elungele uphicotho-zincwadi eyanelisa bobabini abahloli-zincwadi kunye enterprise ukuthenga.
- Idibanisa isitokhwe kunye nokunyanzeliswa komthetho, ukuze ukwazi ukwenza into oyifumanayo.
Ukusuka kwimpahla ukuya kwisenzo: ukukhusela oko ukufumeneyo
Ukufumanisa linyathelo lokuqala; elesibini kukuqonda ukuba zeziphi izinto ezithwala umngcipheko wokwenene, kuba uninzi lwazo aluyi kuba njalo. Injongo kukutshintsha ukusuka kumawaka ezinto ezifunyenweyo ezingacwangciswanga ukuya kwizinto ezimbalwa ezinokubeka emngciphekweni iinkqubo, idatha okanye imisebenzi: ezo zisetyenziswayo, ezamkela igalelo elingathembekanga, ezinokuxhaphazwa ngokwenene, ezigcina ukufikelela okunobuzaza, kwaye zichaphazela imveliso okanye ii-asethi ezilawulwayo.
Kulapho uLawulo lweSimo soKhuseleko lwe-AI (I-AI-SPM) ukuthathwa kwezinto: ukuthatha izinto ezikhoyo, ukufumana umngcipheko kwindlela yokuhlaselwa yi-AI, ukuzidibanisa nemigaqo, kunye nokuvelisa i-AI-BOM. Kukwalapho izinto ezikhoyo zihlangabezana nokunyanzeliswa khona: ukuvala ukuxhomekeka okunobungozi ngaphambi kokuba zifakwe, ukwala iiseva kunye neemodeli ze-MCP ezingavunywanga, kunye nokuqulatha iindawo zokugqibela ezisengozini ngaphambi kokuba isiganeko sisasazeke.
At I-Xygeni, le yimodeli esiyakhela kuyo: uluhlu lwe-AI oluqhubekayo kunye ne-AI-BOM nge-AI-SPM, ukufunyanwa kwe-malware ebamba iipakethe ezinobungozi ngaphambi kokuba kubekho utyikityo (I-MEW, Isilumkiso saKwangoko seMalware), kunye nokunyanzeliswa komgaqo-nkqubo kwindawo yokugqibela yomphuhlisi ngeXygeni Shield. Ukufunyanwa kuhambelana ne-OWASP Top 10 yeZicelo ze-LLM, i-OWASP Top 10 yeZicelo ze-Agency kunye ne-OWASP MCP Top 10. Kodwa nokuba yeyiphi na indlela oyikhethayo, umgaqo uthi: Awukwazi ukukhusela into ongayiboniyo, kwaye uluhlu lwe-AI kulapho ukubonakala kuqala khona.
FAQs
Yahluke njani i-AI-BOM kwi- SBOM?
An SBOM Iikhathalogu zixhomekeke kwisoftware evulelekileyo kunye nesoftware yomntu wesithathu, zinikwe amanqaku ngokobunzima beCVE. Ikhathalogu ye-AI-BOM inika amanqaku e-AI (iimodeli, iiarhente, iiseva ze-MCP, iiseti zedatha) kunye namanqaku engozi e-AI kunye nemephu yokulawula. Njengoko i-AI isasazeka kulo lonke SDLC, i-AI-BOM iya isiba sisiseko njenge SBOM.
Yintoni i-shadow AI kwaye ndiyifumana njani?
I-Shadow AI yiyo nayiphi na i-AI eyamkelweyo ngaphandle kwemvume okanye ulawulo olusemthethweni: i-copilot evunyiweyo, iseva ye-MCP yasekuhlaleni, imodeli ethathwe kwindawo kawonke-wonke. Uyifumana nge-inventory eqhubekayo ezenzekelayo efikelela kwikhowudi, yakha pipelines kunye neendawo zokugqibela zomphuhlisi, kungekhona nje ilifu lemveliso apho uninzi lwe-AI yesithunzi ingaveli khona.
Ngaba uMthetho we-EU AI ufuna uluhlu lwezinto ezisetyenzisiweyo ze-AI?
UMthetho we-EU AI awukhankanyi ngokucacileyo "uluhlu lwe-AI", kodwa uxwebhu lwayo, imisebenzi yokwahlulahlula kunye nokubhalisa kwiinkqubo ezinobungozi obuphezulu akunakwenzeka ukuba kuhlangatyezwane nalo ngaphandle kwalo. Oku kuyafana ne-NIST AI RMF (umsebenzi weMap, uRhulumente 1.6) kunye ne-ISO/IEC 42001, efuna ukuba kugcinwe uluhlu lweenkqubo ze-AI.
Yintoni i-AI-SPM?
Ulawulo lweMeko yoKhuseleko lwe-AI (AI-SPM) yindlela yokufumanisa rhoqo ii-asethi ze-AI, ukuvavanya umngcipheko wazo kwindlela yokuhlasela kwe-AI, ukuzidibanisa nemithetho, kunye nokuvelisa i-AI-BOM. Yandisa ingcinga yokulawula ukuma (eyaziwa yi-CSPM kunye ne-DSPM) kwii-asethi ezithile ze-AI kunye neevektha zohlaselo.
I-inventory ye-AI kufuneka ihlaziywe kangaphi?
Ngokuqhubekayo. Iiasethi ze-AI ziyatshintsha imihla ngemihla njengoko amaqela esamkela iimodeli ezintsha, ethumela iiarhente ezintsha kwaye elungiselela iiseva ezintsha ze-MCP, ngesiqhelo ngaphandle kwemvume esemthethweni. Ukuskena ngexesha elithile kuyaphela kwiintsuku ezimbalwa, ngoko ke isoftware ye-AI esebenzayo isebenza njengenkqubo eqhubekayo endaweni yokuhlolwa kube kanye.
Ndiyisebenzisa njani i-AI ye-inventory kwikhowudi yomthombo?
Ukubeka uluhlu lwe-AI kwikhowudi kuthetha ukufumana iimodeli ze-AI kunye neelayibrari ezitsalelwe njengee-dependencies, abancedisi bekhowudi ye-AI abacwangcisiweyo ngomphuhlisi ngamnye, kunye neeseva ze-MCP okanye iifayile zolawulo ezisebenza ngaphakathi. Oku kufuna ukufunyanwa okusebenza ngaphakathi SDLC (iindawo zokugcina izinto, ukwakha pipelines kunye neendawo zokugqibela zomphuhlisi) endaweni yokuba zibekwe kwiikhonsoli zelifu kuphela.
