An Inventory ye-AI ikhathalogi ebuyekezwa njalo yazo zonke izimpahla ze-AI ezisebenza enhlanganweni yakho — amamodeli, ama-endpoints asebenzisa i-AI, amasethi edatha, abasizi bokubhala ikhodi ye-AI, amaseva e-MCP kanye nokuncika kwe-AI — kanye nobudlelwano, izingozi kanye nabanikazi ababaxhumanisayo. Esimweni sokuphepha lokhu akuhlobene nokuphathwa kwempahla yokugcina impahla noma isitokwe; lapha, "Isitoko se-AI" kusho nje ukwazi kahle ukuthi iyiphi i-AI oyisebenzisayo, ukuthi ihlala kuphi, nokuthi ingafinyelela ini.
Njengoba i-AI isakazeka kuzo zonke izigaba zokuthuthukiswa kwesofthiwe, kusukela ekwakhiweni kwekhodi ku-IDE kuya kuma-ejenti azimele asebenza ngaphakathi CI/CD pipelines, umbuzo awusekho ukuthi ngabe i-AI ikhona yini endaweni yakho. Kungukuthi ungakubona yini. Lo mhlahlandlela uchaza ukuthi iyini inventory ye-AI, ukuthi ihlobene kanjani ne- I-AI-BOM futhi a SBOM, ngani isithunzi AI sekuyinkinga yezokuphepha, nokuthi umkhuba uhambisana kanjani ne- Umthetho we-EU AI, I-NIST AI RMF futhi I-ISO / i-IEC 42001.
Ukuthatha okhiye
- Isitokwe se-AI sihlela yonke imodeli, isethi yedatha, i-ejenti, iseva ye-MCP kanye nethuluzi lokubhala ikhodi le-AI kulo lonke umjikelezo wakho wokuphila kwesofthiwe, hhayi nje lezo ezivunyelwe yi-IT.
- Isithunzi AI, i-AI eyamukelwe ngaphandle kokubusa, manje isiyinto evamile, akuyona into ehlukile: kolunye ucwaningo lwabaholi bezokuphepha lwango-2026, kuphela Izinhlangano ezingu-19% zibike ngokubona okugcwele ukuthi i-AI isetshenziswa kuphi futhi kanjani.
- An I-AI-BOM (Umthethosivivinywa Wezinto Ezisetshenziswayo ze-AI) umphumela wokulungela ukuhlolwa kwempahla ye-AI: umlandeli wesikhathi se-AI SBOM.
- Umthethonqubo uyafika. Umthetho we-EU AI, i-NIST AI RMF kanye ne-ISO/IEC 42001 konke kudinga ukuthi wazi ukuthi iyiphi i-AI oyisebenzisayo.
- Isitokwe siyindawo yokuqala kuphela; inani livela ekutholeni ingozi kanye nokusebenza enanini elincane lezimpahla ezibaluleke ngempela.
Iyini i-inventory ye-AI?
Isitokwe se-AI siwumkhuba wokuthola, ukuhlela kanye nokuqapha njalo yonke impahla ye-AI esebenza kuyo yonke impilo yakho yokuthuthukiswa kwesofthiwe, kanye nezingozi ezihambisana nayo ngayinye. Isitokwe esiphelele siphendula imibuzo emithathu yempahla ngayinye: iyini, isebenza kuphi, futhi yini engayithola?
Leso silinganiso sibanzi kunalokho amaqembu amaningi akulindele. Isitokwe se-AI esinengqondo kufanele sihlanganise:
- models: yonke imodeli yolimi olukhulu kanye nemodeli yesisekelo esetshenziswa kuyo yonke intuthuko kanye nokukhiqiza, ngenguqulo, indawo kanye nokuzethemba kokuthola.
- Ama-Datasets: idatha yokuqeqesha, amasethi edatha okuthola kanye nezitolo ze-vector, okuhlanganisa ukuchayeka kumongo onobuthi kanye nokuvuza kwedatha.
- agents: izinhlelo ezizimele ezithatha izinyathelo endaweni yakho, njengokuvula pull requests, ukufaka izinto ezixhomeke kuzo, noma ukuthinta ingqalasizinda.
- Amaseva e-MCP: Iphrothokholi Yokuqukethwe Kwemodeli amaseva axhumanisa abasizi be-AI namathuluzi angaphandle, ama-API kanye nemithombo yedatha.
- Amathuluzi nabasizi bokufaka amakhodi e-AI: ama-copilot kanye nokuhlanganiswa kwe-IDE okukhiqiza ikhodi, phakamisa ukuncika futhi usebenzisane nama-repository.
- Izinhlaka ze-AI: I-LangChain, i-LangGraph, amaseva e-ejenti kanye nezinye izendlalelo zokuhlelwa ezixhumanisa amamodeli kumathuluzi nedatha.
- Ubudlelwano phakathi kwezimpahla: ukuxhumana phakathi kwamamodeli, ama-ejenti, amaseva, amasethi edatha kanye nezimfihlo ezihambisana nawo. Igrafu yobudlelwano yenza ingozi ibonakale kumongo, hhayi njengohlu oluyisicaba.
Isitokwe se-AI uma siqhathaniswa nesitokwe sempahla ye-AI uma siqhathaniswa ne-AI-BOM, nokuthi sihluke kanjani ku- SBOM
La magama asetshenziswa ngokunganaki, ngakho-ke kuyasiza ukuba ngaphambi kosuku lokuphelelwa yisikhathi.cise. "Isitoko se-AI" kanye "nesitoko se-AI" kuchaza into efanayo: ikhathalogi ephilayo yezimpahla ze-AI kanye nezingozi zazo. I-AI-BOM yinto yobuciko ethunyelwa kwamanye amazwe ekhiqizwa yisitolo: ibhili lezinto ezifundwa ngomshini ongazinika umhloli wezincwadi noma enterprise umthengi.
Indlela ehlanzekile yokuqonda i-AI-BOM iwukufaniswa ne- SBOM:
Njengoba i-AI ingena ngaphakathi kwe-inthanethi SDLC, i-AI-BOM isiba yisisekelo njenge- SBOM, futhi abaholi bezokuphepha bayaqhubeka nokuthola izicelo ezivela kubahloli bamabhuku kanye enterprise amaqembu okuthenga ngalo kanye lo msebenzi wobuciko.
Kungani isitokwe se-AI sibalulekile manje
Amandla amathathu aguqule isitokwe se-AI kusuka ekubeni yinto enhle kakhulu yaba yinto eza kuqala.
- Okokuqala, i-AI ibhala ikhodi engavikelekile ngezinga. Ucwaningo oluzimele luthola njalo ukuthi ingxenye enkulu yamakhodi akhiqizwe yi-AI ahamba nobuthakathaka. Ucwaningo lokuqala lwe-NYU/Copilot olwenziwa nguPearce et al. luthole cishe ukuthi luhlobene nokukhubazeka. Ama-40% ezinhlelo ezikhiqizwe aqukethe ubuthakathaka bokuphepha, kanye namaphuzu okuhlola amakhulu akamuva ngendlela efanayo: Ukuhlaziywa kukaVeracode ngo-2025 kumamodeli angaphezu kwe-100 kutholakale kuphela Ama-55% ekhodi ekhiqizwe yi-AI ayephephileUma ungazi ukuthi yibaphi abasizi abakhiqiza ikhodi ku- pipelines, awukwazi ukulawula leyo ngozi.
- Okwesibili, uchungechunge lokuhlinzekwa kwesofthiwe seluphenduke indawo yokuhlasela ye-AI. Ngo-September 2025, Shai Hulud, i-npm worm yokuqala ezikhulisa ngokwayo, yaguqula imishini yonjiniyela yaba yindlela yokusabalalisa, yasakazeka emaphaketheni amaningi. NgoMashi 2026, abahlaseli bafaka isandla ekuthuthukisweni kwe- axios, iphakheji ene- Ukulanda kwezigidi eziyi-100 masonto onke, ishicilela izinguqulo ezinobuthi ezilahle i-trojan yokufinyelela kude. Ukuhlasela okunjengalokhu kuwela ngqo kungqimba ephakathi kwe-AppSec yendabuko kanye namathuluzi okugcina: ungqimba i-AI inventory eyakhelwe ukukhanyisa.
- Okwesithathu, izimfihlo kanye neziqinisekiso ziyavuza nge-AI. I-State of Secrets Sprawl ka-2026 ka-GitGuardian ibike ukuthi ukuvuza kwezimfihlo ze-AI-service kukhuphuke ngo-81% unyaka nonyaka, nokuthi lokho kusizakala nge-AI commits leak secrets cishe kabili kunesilinganiso esiyisisekelo. Yonke imodeli engabhalisiwe, i-ejenti noma iseva ye-MCP iyindlela engaba khona yokuthola iziqinisekiso.
I-AppSec yendabuko ima endaweni yokugcina futhi ayiqondi ukuthi imodeli iyini. Amathuluzi e-Endpoint abuka uhlelo lokusebenza kodwa awaqondi amaphakheji, amaseva e-MCP noma abasizi be-AI. Igebe eliphakathi kwawo yilapho ingozi ye-AI iqongelela khona, futhi isitokwe yisinyathelo sokuqala sokuyivala.
Lapho i-AI icasha khona: Isithunzi se-AI ngaphesheya kwe- SDLC
Isithunzi AI yinoma yiluphi uhlelo lwe-AI olwamukelwe ngaphandle kwemvume noma ukubusa okusemthethweni: i-copilot enikwe amandla unjiniyela ngesonto eledlule, iseva ye-MCP isebenza kwi-laptop, imodeli idonswe ngqo kusuka endaweni yomphakathi yaya kuphrojekthi eseceleni. Akuyona inkinga engaba khona. Ocwaningweni lwango-2026 lwabaholi bezokuphepha abangaphezu kuka-400, kuphela Abangu-19% babike ukuthi bayazi kahle ukuthi i-AI isetshenziswa kuphi futhi kanjani kuyo yonke inhlangano yabo, kuyilapho iningi elikhulu lase livele lisebenzisa noma lihlola abasizi bokubhala amakhodi be-AI.
I-AI yesithunzi enzima kakhulu ukuyithola yi-AI ngaphakathi komjikelezo wokuphila kwesofthiwe, ngoba ayibonakali kakhulu kukhonsoli yamafu:
- Amamodeli kanye nemitapo yolwazi ye-AI kudonswe ezindaweni zokugcina izinto njengezixhomeke kuzo.
- Abasizi bokubhala amakhodi be-AI abalungiselelwe ngonjiniyela ngamunye, nge-IDE ngayinye.
- Amaseva e-MCP namafayela omthetho asebenza endaweni kuma-endpoints onjiniyela.
- Imisebenzi ye-ejensi ivuleka buthule pull requests noma ukufaka amaphakheji.
Yingakho ukutholwa kwe-cloud kuphela kunganele. Isitokwe se-AI esiphelele ngempela kufanele sifinyelele ikhodi futhi sakhe izindawo (i-laptop yonjiniyela, indawo yokugcina, pipeline), hhayi nje ifu lokukhiqiza.
Okufanele i-AI-BOM
I-AI-BOM elungele ukuhlolwa iguqula isitokwe sakho sibe yinto ongayifakazela. Okungenani, kufanele ifake:
- Yonke impahla ye-AI: amamodeli, amasethi edatha, ama-ejenti, amaseva e-MCP, amathuluzi okubhala ikhodi ye-AI.
- Uhlobo lwefa, indawo kanye nokuzethemba kokutholwa ngakunye.
- Imvelaphi kanye nokuncika (lapho imodeli noma ingxenye ivela khona).
- Izinga lobungozi ngempahla ngayinye, ngokusekelwe kumavektha okuhlasela athile e-AI.
- Ukuhlelwa kwemephu yokulawula kuMthetho we-EU AI, i-NIST AI RMF kanye ne-ISO/IEC 42001.
- Ifomethi ethunyelwa kwamanye amazwe, efundeka ngomshini yabahloli bamabhuku namakhasimende.
Izinhlangano ezingakhiqiza i-AI-BOM uma kudingeka zizoba nethuba langempela lokuthobela imithetho kanye nokuthembana njengoba izibopho zokuhlolwa kwe-AI zivuthwa.
Isitokwe se-AI kanye nokuhambisana nayo: Umthetho we-EU AI, i-NIST AI RMF kanye ne-ISO/IEC 42001
Akukho noyedwa kuzinhlaka ezinkulu obiza "isitokwe se-AI" njengento yomugqa, kodwa ngayinye akunakwenzeka ukuyifeza ngaphandle kwayo. Awukwazi ukubhala phansi, ukuhlukanisa noma ukulawula izinhlelo ze-AI ongaziboni.
Inothi ngesikhathi: ukuqaliswa koMthetho we-EU AI kubuyekezwe yisivumelwano sikaMeyi 2026 esithi “Digital Omnibus”, esasihlehlisela izibopho eziningi ezinobungozi obukhulu kuDisemba 2027, ngenkathi sigcina izigigaba eziningana zangomhlaka-2 Agasti 2026 zibukhoma (imisebenzi yokucaca, amandla esijeziso se-GPAI). Phatha izinsuku eziqondile njengenhloso ehambayo futhi uqinisekise ngokumelene nemithombo eyinhloko ye-EU. Kodwa isiqondiso sokuhamba sicacile, futhi isitokwe siyisidingo sakho konke.
Indlela yokwakha nokugcina uhlu lwe-AI
Ukwakha isitokwe akudingi ukuhlolwa okukodwa kodwa kudinga ukusungula inqubo eqhubekayo, ngoba izimpahla ze-AI ziyashintsha njalo: kwamukelwa amamodeli amasha, kuthunyelwa ama-ejenti amasha, kulungiswa amaseva amasha e-MCP, ngokuvamile ngaphandle kwemvume.
Indlela engokoqobo:
- Thola ngokuzenzakalelayo kukhodi, ukwakheka kanye nefu. Amaspredishithi enziwa ngesandla ayaphela zingakapheli izinsuku. I-Discovery kufanele iqhubeke njalo futhi ifinyelele ku- SDLC, hhayi nje isikhathi sokusebenza.
- Hlela futhi uhlele ubudlelwano. Uhlobo lwerekhodi, indawo, imvelaphi kanye, ngokujulile, indlela impahla ngayinye exhumana ngayo nabanye kanye nezimfihlo.
- Ingozi yamaphuzu ngokomongo. Uhlu oluqondile lwamakhulu ezinto ezitholakele alusizi muntu; lubeka phambili lokho okufinyelelekayo, okusebenzisekayo nokubalulekile kwebhizinisi.
- Nika ubunikazi. Yonke impahla idinga umnikazi ophendulayo.
- Yigcine ibukhoma futhi ikwazi ukuthekeliswa kwamanye amazwe. Yigcine njengempahla eqhubekayo engakhiqiza i-AI-BOM uma kudingeka.
Okufanele ukubheke kusofthiwe ye-AI yokusungula impahla
Uma uhlola amathuluzi, lawa amakhono ahlukanisa isofthiwe yesitoko se-AI yangempela ohlwini olungaguquki:
- Uyaqonda izinhlobo zezimpahla ezithile ze-AI (amamodeli, ama-ejenti, amaseva e-MCP, amasethi edatha), hhayi amaphakheji nemitapo yolwazi kuphela.
- Ifinyelela ku- SDLC, ukuthola i-AI kukhodi kanye nama-endpoints onjiniyela, hhayi efwini kuphela.
- Ubudlelwano beMaps, hhayi nje izimpahla ngazinye, ngakho-ke ingozi iyabonakala kumongo.
- Ingozi yamaphuzu kuma-vector okuhlasela athile e-AI (ukujova ngokushesha, i-MCP engavikelekile, ukuzibophezela ngokweqile), hhayi nje kuphela ubukhali be-CVE.
- Isebenza njalo, ukubamba i-AI entsha njengoba kubonakala.
- Ikhiqiza i-AI-BOM elungele ukuhlolwa lokho kwanelisa kokubili abahloli bezimali kanye enterprise ukuthenga.
- Ixhumanisa isitokwe nokusetshenziswa kwemithetho, ukuze ukwazi ukwenza okuthile ngalokho okutholayo.
Kusukela esitokweni kuya esenzweni: ukuvikela lokho okutholayo
Ukuthola kuyisinyathelo sokuqala; esesibili ukuqonda ukuthi yiziphi izimpahla ezinengozi yangempela, ngoba eziningi ngeke zikwazi. Umgomo uwukushintsha kusuka ezinkulungwaneni zezinto ezitholwe ngendlela engafanele uye kwembalwa engalimaza izinhlelo, idatha noma imisebenzi: lezo ezisetshenziswayo, ezamukela okufakiwe okungathembekile, ezingasetshenziswa ngokoqobo, ezibamba ukufinyelela okubucayi, futhi ezithinta ukukhiqizwa noma izimpahla ezilawulwayo.
Yilapho Ukuphathwa Kwesimo Sokuphepha se-AI (I-AI-SPM) ukuqoqa: ukuthatha isitokwe, ukufaka ubungozi endleleni yokuhlasela kwe-AI, ukuyihlanganisa nemithetho, nokukhiqiza i-AI-BOM. Kulapho futhi isitokwe sihlangabezana khona nokuphoqelelwa: ukuvimba ukuncika okunonya ngaphambi kokufaka, ukwenqaba amaseva namamodeli e-MCP angagunyaziwe, kanye nokuqukatha ama-endpoints asengozini ngaphambi kokuba isigameko sisabalale.
At I-Xygeni, lena imodeli esakhela kuyo: isitokwe se-AI esiqhubekayo kanye ne-AI-BOM nge-AI-SPM, ukutholwa kwe-malware okubamba amaphakheji anonya ngaphambi kokuba kube nesiginesha (Isexwayiso Sasekuqaleni se-MEW, i-Malware), kanye nokuqiniswa kwenqubomgomo endaweni yokugcina yonjiniyela nge-Xygeni Shield. Ukutholwa kuhambisana ne-OWASP Top 10 yezinhlelo zokusebenza ze-LLM, i-OWASP Top 10 yezinhlelo zokusebenza ze-Agency kanye ne-OWASP MCP Top 10. Kodwa noma iyiphi indlela oyikhethayo, isimiso siyasebenza: Awukwazi ukuvikela lokho ongakwazi ukukubona, futhi isitokwe se-AI yilapho ukubonakala kuqala khona.
Imibuzo Evame Ukubuzwa
Ihluke kanjani i-AI-BOM ku- SBOM?
An SBOM Amakhathalogi abonisa ukuncika kwesofthiwe yomthombo ovulekile kanye neyenkampani yangaphandle, athola amaphuzu ngobunzima be-CVE. Amakhathalogi e-AI-BOM athola amaphuzu athile e-AI (amamodeli, ama-ejenti, amaseva e-MCP, amasethi edatha) anamaphuzu athile engozi e-AI kanye nemephu yokulawula. Njengoba i-AI isakazeka kulo lonke SDLC, i-AI-BOM isiba yisisekelo njenge- SBOM.
Iyini i-shadow AI futhi ngiyithola kanjani?
I-Shadow AI yinoma iyiphi i-AI eyamukelwa ngaphandle kwemvume noma ukubusa okusemthethweni: i-copilot enikwe amandla, iseva ye-MCP yendawo, imodeli ekhishwe endaweni yomphakathi. Uyithola ngempahla ezenzakalelayo eqhubekayo efinyelela kukhodi, yakha pipelineama-s kanye nama-endpoints onjiniyela, hhayi nje ifu lokukhiqiza lapho iningi le-AI yesithunzi lingabonakali khona.
Ingabe uMthetho we-EU AI udinga uhlu lwe-AI?
UMthetho we-EU AI awusho igama elithi “inventory ye-AI” ngokusobala, kodwa imibhalo yawo, ukuhlukaniswa kanye nemisebenzi yokubhalisa yezinhlelo ezinobungozi obukhulu akunakwenzeka ukuyifeza ngaphandle kwayo. Kunjalo nange-NIST AI RMF (Umsebenzi weMephu, uHulumeni 1.6) kanye ne-ISO/IEC 42001, edinga ukugcina inventory yezinhlelo ze-AI.
Kuyini i-AI-SPM?
Ukuphathwa Kwesimo Sokuphepha se-AI (AI-SPM) kuwumkhuba wokuthola njalo izimpahla ze-AI, ukulinganisa ubungozi bazo endleleni yokuhlasela kwe-AI, ukuzihlanganisa nemithetho, nokukhiqiza i-AI-BOM. Kwandisa ukucabanga kokuphathwa kwesimo (okujwayelekile ku-CSPM kanye ne-DSPM) kuya ezimpahleni ezithile ze-AI kanye nezivikeli zokuhlasela.
Isitokwe se-AI kufanele sibuyekezwe kangaki?
Ngokuqhubekayo. Izimpahla ze-AI ziyashintsha nsuku zonke njengoba amaqembu amukela amamodeli amasha, ethumela ama-ejenti amasha futhi elungiselela amaseva amasha e-MCP, ngokuvamile ngaphandle kwemvume esemthethweni. Ukuskena kwesikhathi kuyaphela zingakapheli izinsuku, ngakho-ke isofthiwe yesitoreji se-AI esebenzayo isebenza njengenqubo eqhubekayo kunokuba ukuhlolwa okukodwa.
Ngiyisebenzisa kanjani i-AI yempahla yami kukhodi yomthombo?
Ukufaka i-AI kukhodi kusho ukuthola amamodeli e-AI kanye nemitapo yolwazi edonswe njengezinto ezixhomeke kuzo, abasizi bokubhala ikhodi ye-AI abamisiwe ngonjiniyela ngamunye, kanye namaseva e-MCP noma amafayela okulawula asebenza endaweni. Lokhu kudinga ukuthola okusebenza ngaphakathi kwe-AI SDLC (izindawo zokugcina, ukwakha pipelines kanye nama-endpoints onjiniyela) kunokuba kube kuma-consoles amafu kuphela.
