AI-BOM (Artificial Intelligence Bill of Materials) provides Software Composition Analysis (SCA) for agentic AI. You can scan AI agent skill packages before deploying them to identify underlying models, dependencies, third-party libraries, and known security vulnerabilities.
This feature is in Limited Availability. If you want to enable this feature in your tenant, contact your sales team.
About AI-BOM
Modern AI agents assemble models, tools, and third-party skills dynamically. AI-BOM eliminates the visibility gap across your agent supply chain by inspecting agent skill packages and generating a cryptographically signed CycloneDX JSON manifest.
The scan evaluates your agent artifacts against known vulnerability databases and provenance sources, providing risk scoring across multiple operational dimensions.
Key Capabilities
AI-BOM provides the following capabilities:
- Scans uploaded AI skill packages in .zip format.
- Identifies declared dependencies and cross-references them with NVD and OSV vulnerability databases.
- Generates structured inventories across standard and AI-specific components:
- SBOM: Traditional software packages and libraries.
- SaaS-BOM: External APIs, SaaS endpoints, and network dependencies.
- ML-BOM: Base LLM identifiers and AI model dependencies.
- CBOM: Cryptographic algorithms and key configurations.
- Skill-BOM: Agent instructions, execution graphs, and tool invocation patterns.
- Calculates weighted risk scores across six dimensions: vulnerabilities, secrets, cryptography, SaaS integrations, ML models, and skill execution graphs.
How AI-BOM Works
The AI-BOM lifecycle follows an asynchronous scan and retrieval workflow:
- Submission: You upload your agent skill archive (.zip) through the Submit API (
POST /v1/scans). - Analysis: The OASIS scanning engine extracts components, maps tool execution graphs, and checks dependencies against vulnerability registries.
- Retrieval: You query the status and fetch the signed CycloneDX JSON report through the Report API (
GET /v1/reports/{hash}) using the artifact SHA-256 or MD5 hash.
Data Residency Notice
Netskope processes AI-BOM scanning workloads in regional data centers. APAC tenants are processed in us-west-2 pending a dedicated regional deployment.
Related Topics
To learn more: