SupplyTrust
End-to-End Visibility. From Code to Cloud.

An SBOM lists the software components in a build — packages, libraries, base image layers. An AI-BOM extends the same idea to the AI supply chain: which pretrained models, fine-tuning datasets and vector stores a system depends on, and where each came from. SupplyTrust produces both from the same inventory.

SPDX and CycloneDX, the two formats tooling and auditors actually consume. Inventories are generated per build and kept versioned, so you can produce the bill of materials for a specific released artefact rather than for today's main branch.

Most components a disclosure names are present but not reachable in your code path. A VEX statement records that judgement — affected, not-affected, under investigation, fixed — with the reasoning attached, so the same finding does not have to be re-triaged by every team that inherits it.

No. VulSense finds and prioritises vulnerabilities across the running estate; SupplyTrust answers what is in what you ship, where it came from and whether you can trust it. They share one asset graph, so a disclosure reaching a component resolves straight to the services and images that carry it.

Both. Licence rules, minimum versions, banned components and unsigned-artefact rules can be reported for visibility first, then enforced as pipeline gates once you are confident in the inventory.