How Sonatype Leads in AI Component Analysis for Software Supply Chain Security

June 24, 2025
By Aaron Linskens

5 minute read time

From generative AI tools to pre-trained machine learning models, AI rapidly transforms how software is developed.

But with this transformation comes a shift in risk, introducing new attack vectors and vulnerabilities within the software supply chain. The components that power AI systems, including libraries, models, and training data, now demand the same level of scrutiny as traditional open source dependencies.

In the fourth of our four-part series on The Forrester Wave™: SCA Software report, let's explore how Sonatype is helping organizations address the emerging risks of AI-powered development through advanced AI component analysis.

Why AI Analysis Matters to the Software Supply Chain

The modern software stack increasingly includes not just packages and libraries, but also AI models, many of them open source. These components can be opaque, difficult to audit, and vulnerable to malicious tampering.

That's why forward-looking organizations are expanding their software composition analysis (SCA) efforts to include AI component analysis.

SCA solutions are evolving to cover more than just license compliance and known vulnerabilities. They are now essential for understanding operational risk, software provenance, and malicious behavior, especially in AI-powered applications.

New questions emerge:

• Is the AI model from a reputable source?
• Has the model or training dataset been tampered with?
• Could the model introduce backdoors or leak sensitive data?
• Is the component maintained, transparent, and observable?

Without clear answers, organizations face exposure to "shadow AI" and open source models that behave like black boxes, inviting security, compliance, and operational challenges.

Sonatype's AI Component Analysis: A New Standard for SCA

Sonatype was recognized in the Forrester Wave for trailblazing features that go beyond traditional SCA. That includes advanced support for analyzing open source frameworks, libraries, and AI models for suspicious or malicious behavior.

Here's how Sonatype stands out:

• Detects threats in open source AI models. Sonatype scans open source AI models pipelines for indicators of compromise, helping teams avoid poisoned or trojanized models that can sabotage software performance or exfiltrate data.
• Blocks risky AI components at the perimeter. With Sonatype Firewall, organizations can quarantine or automatically block known malicious packages, including AI-related ones, before they enter the build pipeline.
• Surfaces software health and provenance. From package pedigree to project activity, Sonatype provides deep insight into component trustworthiness, even as AI accelerates third-party adoption.
• Paves the way for AI BOMs. As noted in the report, generation of AI Bills of Materials (AI BOMs) is "on the horizon." Sonatype is already investing in this future, helping organizations get ahead of coming compliance needs.

These features are built into the Sonatype Platform, where policy enforcement and risk evaluation happen directly in developer environments, CI/CD pipelines, and even the browser, keeping AI risks visible and manageable from code to production.

Forrester Highlights Sonatype's Differentiated Approach

In its evaluation, Forrester recognized Sonatype for pioneering new capabilities that help organizations gain visibility and control over AI and ML components.

While many vendors are just beginning to address this problem, Sonatype already delivers AI model analysis and next-generation software supply chain defenses, including:

• Detects malicious behavior in open source AI components using proprietary intelligence and behavioral analysis.
• Surfaces AI-related security insights directly in the IDE, CI/CD pipeline, and browser for faster remediation.
• Enforces AI-specific security policies across the entire SDLC.
• Blocks risky AI libraries and models at the perimeter with Sonatype Firewall before they enter your environment.

Sonatype's Vision for AI BOMs and the Future of SCA

While software bills of materials (SBOMs) have become essential for transparency and compliance, the rise of AI introduces a new frontier: AI BOMs.

Sonatype is already laying the groundwork for AI BOM creation and management — capabilities Forrester identifies as a forward-looking strength.

Our roadmap includes:

• AI BOM generation and support for emerging standards.
• Visibility into model provenance, license metadata, and supply chain integrity.
• Detection of embedded AI components within third-party libraries.
• Governance tooling for shadow AI detection and usage tracking.

Security leaders need to move quickly to keep up, especially as new regulations emerge, and Sonatype is helping them do exactly that.

Start Securing AI Components Now

AI component analysis is not just a future-facing concept. It's already helping organizations reduce risk today.

Whether you are managing open source packages, scanning pre-trained models, or building intelligent applications from the ground up, Sonatype gives you the tools to harness the power of AI throughout the SDLC.

To see how Sonatype is leading AI component analysis and secure software development, download the full Forrester Wave report.

Written by Aaron Linskens
Aaron is a technical writer at Sonatype. He works at a crossroads of technical writing, developer advocacy, and information design. He aims to get developers and non-technical collaborators to work better together in solving problems and building software.