FossID

What's in your software? Detect open source and AI code risk as code is created. Learn more at fossid.com/Agentic

In light of recent news - Adobe clone, Artcraft stirring things up, and Anthropic building their own internal replacement of Git - naturally, everyone's minds are swirling about what else should be vibe-coded as a bespoke software solution for my business? I took a cut at exploring that exact question in this article, "Can an LLM Replace Software Composition Analysis?" Take a look - tell me what you think. Crazy times we live in. It's important we keep our wits about us. #AgenticSCA #SoftwareSupplyChain #SBOM #VibeCoding https://lnkd.in/gNFSwDEB

Developers should not have to become full-time SBOM coordinators. As AI-assisted development increases the speed and volume of code creation, software teams need better ways to support inventory, provenance, security, and license compliance without slowing delivery. That is why we are announcing FossID Workflows. FossID Workflows will help organizations automate the operational side of SBOM management, including intake, normalization, inspection, approval, rejection, consolidation, and compliance-ready evidence. The goal is simple: reduce manual coordination, give engineering teams clearer processes, and help organizations manage software supply chain requirements at scale. SBOMs are becoming part of how modern software is governed. FossID Workflows is being built to make that process more practical. Read more and join the waitlist https://lnkd.in/e_qnzWsE #SoftwareSupplyChain #SBOM #EUCRA

Go from “Do we have an SBOM?” → to → “Can we trust it, maintain it, and act on it continuously?” Most teams don’t struggle to generate an SBOM anymore. They struggle to use it. Once the initial SBOM is created, the real work begins: - Keeping it accurate as code changes - Making it actionable for engineering, security, and compliance teams - Integrating it into real development workflows, not just audits This is where SBOM initiatives often stall, not because of regulation, but because operationalizing them is genuinely hard. That’s why we’re excited to share a new research report: “Beyond the Static SBOM: Operationalizing Software Bill of Materials Across the Full Lifecycle” Authored by Ibrahim Haddad, Ph.D., a recognized leader in open source and software supply chain integrity, this paper provides a practical blueprint for turning SBOMs from static artifacts into living, operational assets. It’s not about theory. It’s about what actually works across the full lifecycle. If you’re thinking about how to move from SBOM generation to SBOM management, this is worth your time. Read the full report: https://lnkd.in/gM-cCJ9m #SBOM

AI-generated code is driving an explosion in software. More code. More snippets. More dependencies. And increasingly, it's being written at machine speed. But most software composition analysis workflows still assume a human pace: write code → commit → scan → review. That model won’t hold for long. As engineering accelerates, SCA has to keep up — running continuously, integrating directly into developer tools, and increasingly becoming something AI agents can call themselves. In our latest Sushi Bytes episode, Shinobi and Gen break down SCA in the AI era and why compliance needs to move just as fast as the code being created. 🎧 Listen here: https://lnkd.in/gajWPSS6 #OpenSource #SoftwareSupplyChain #DevSecOps #AI

Devs vs. Legal: The Modern Software Supply Chain Tug-of-War In this Sushi Bytes episode, we tackle an increasing tension in modern software development: 🧑💻 Developers want frictionless workflows. ⚖️ Legal teams want full compliance. ⚡ The business wants both—yesterday. This episode explores how Software Composition Analysis (SCA) can support productivity without sacrificing control, and why aligning developer experience with legal peace of mind is more achievable than most teams think. 🎙️ Check it out on Sushi Bytes → https://lnkd.in/gcTQgzsr #DevEx #DevOps #IntellectualProperty #SoftwareRisk #SBOM