软件供应链完整性似乎正日益成为企业风险管理中越来越重要的考量因素。与此同时，AI辅助开发不断扩展，软件供应链也增添了更多复杂层面。
Software supply chain integrity appears to be becoming an increasingly important consideration in enterprise risk management. This comes as AI-assisted development expands and software supply chains gain additional complex layers.
这些发展促使企业领导者思考一个根本性问题：他们能否有把握地说明自己开发、采购和部署的软件？对于既追求创新又追求韧性的企业而言，软件透明度或许能提供有价值的基础。它有助于理解知识产权、许可责任以及软件供应链决策的经济影响。
These developments invite business leaders to consider a fundamental question: Can they confidently account for the software they develop, purchase, and deploy? For enterprises pursuing innovation alongside resilience, software transparency may provide a valuable foundation. It can help with understanding intellectual property, licensing responsibilities, and the economic implications of software supply chain decisions.
亚伦·布兰森是FossID的首席增长官。FossID是一家软件组成分析（SCA）公司，专注于源代码情报和软件供应链透明度。他指出，这个问题首先要从对代码本身的可见性开始。
Aaron Branson is chief growth officer of FossID, a software composition analysis (SCA) company specializing in source-code intelligence and software supply chain transparency. He notes that the question begins with visibility into the code itself.
他表示：“组织可以知道自己与哪些供应商合作、采购了哪些软件产品，但要确定这些产品的确切组成，可能需要额外的调查。”
“Organizations can know which suppliers they engage and which software products they procure, but establishing the precise composition of those products can require additional investigation,” he states.
可见性缺口：开源库、传递依赖、供应商开发的组件以及AI生成的代码片段可能通过不同渠道进入代码库。布兰森强调了一个重要区别。供应商记录可以提供有用的背景信息。而检查底层代码则可能进一步揭示其来源及相关义务。
The visibility gap Open-source libraries, transitive dependencies, supplier-developed components, and AI-generated snippets may enter a codebase through different channels. Branson highlights an important distinction. Supplier records can provide useful context. Examining the underlying code may offer further insight into its origins and associated obligations.
这一可见性缺口可能对多个业务职能产生影响。软件来源不明可能使知识产权评估、许可审查、采购决策和客户保证变得更加复杂。
This visibility gap can have implications across several business functions. Unclear software provenance may complicate intellectual property assessments, licensing reviews, procurement decisions, and customer assurances.
布兰森解释说：“一个组织对其软件的理解，会影响它评估所构建资产、所承担义务以及对客户所作承诺时的信心。”在这一背景下，软件透明度有助于在产品全生命周期内做出更明智的决策。AI改变了节奏，AI辅助开发为这一挑战增添了另一个维度。
Branson explains, “An organization’s understanding of its software can influence how confidently it evaluates the assets it builds, the obligations it accepts, and the commitments it makes to customers.”Software transparency, in this context, can support more informed decisions across the product lifecycle. AI changes the pace AI-assisted development adds another dimension to this challenge.
“随着开发速度加快，企业需要调整其监督方式，”布兰森说。“AI可以在几秒钟内生成代码，但我们的审查流程、文档记录和合规检查根本没有为这种速度做好准备。此外，片段式的代码可能悄悄进入应用程序，却从未出现在标准的依赖关系记录中。”他补充说，因此，各组织不妨审视自己如何编制软件清单，也可以检查这些记录在多大程度上可靠地反映了实际使用的代码。
“Companies need to adjust their oversight as development moves faster,” Branson says. “AI can pump out code in seconds, but our review processes, documentation, and compliance checks just aren’t set up for that speed. Plus, snippet-sized code can sneak into applications without ever showing up in standard dependency records.”He adds that as a result, organizations may benefit from examining how they compile their software inventories. They may also check how reliably those records reflect the code in use.
在这一过程中，文档的质量至关重要。软件物料清单（SBOM）可以提供软件组件和依赖关系的结构化清单，帮助团队整理复杂产品中的信息。美国网络安全和基础设施安全局（CISA）发布的《2026年软件物料清单最低要素》就SBOM可能包含的信息及其在软件供应链透明度中的作用提供了指导。
The quality of documentation matters within this process. Software Bills of Materials (SBOMs) can provide structured inventories of software components and dependencies. They help teams organize information across complex products. CISA’s 2026 Minimum Elements for a Software Bill of Materials provides guidance on the information an SBOM may contain and its role in software supply chain transparency.
对于从多个供应商处接收软件的企业而言，这些清单的价值可能取决于所提供信息的详细程度、一致性和时效性。源代码分析可以补充依赖关系文档，帮助团队评估组件记录是否与正在审查的软件相符。
For enterprises receiving software from multiple suppliers, the value of these inventories may depend on the detail, consistency, and currency of the information provided. Source-code analysis can complement dependency documentation. It helps teams assess whether component records correspond with the software they are examining.
从溯源到履责 FossID 在软件成分分析方面的工作直接关联到对可验证信息的这一需求。FossID 设计其技术旨在识别开源组件、许可证以及第三方代码片段。这包括仅靠包声明可能难以追踪的材料。这种能力可以帮助组织调查包含第三方贡献或 AI 辅助代码的软件的构成。
From origin to obligation FossID’s work in software composition analysis relates directly to this need for verifiable information. FossID designed its technology to identify open-source components, licenses, and third-party code fragments. That includes material that may be difficult to trace through package declarations alone. This capability can help organizations investigate the composition of software that incorporates third-party contributions or AI-assisted code.
“当团队能够将组件的来源与其可能带来的责任联系起来时，软件溯源就变得更有用，”Branson 指出。
“Software provenance becomes more useful when teams can connect a component’s origin with the responsibilities that may follow it,” Branson remarks.
此类信息可为工程、法务、安全和合规团队提供共同依据，以评估软件决策。
Such information can give engineering, legal, security, and compliance teams a shared basis for evaluating software decisions.
这些考量还表明，有机会将治理更直接地融入日常工作。软件成分和许可证检查可成为开发流水线、采购审查和供应商管理流程的一部分。当团队随着软件变更刷新组件信息时，他们可能会发现更容易评估新依赖、审查许可要求，并为产品或监管评估做准备。
These considerations also suggest an opportunity to integrate governance more directly into everyday work. Software composition and licensing checks can become part of development pipelines, procurement reviews, and supplier-management processes. When teams refresh component information as software changes, they may find it easier to assess new dependencies, review licensing requirements, and prepare for product or regulatory evaluations.
组织可将这项工作的责任分派给各职能部门。工程部门提供技术背景，法务团队解读义务，采购部门审查供应商信息，领导层确立优先级和问责制。
Organizations can distribute responsibility for this work across functions. Engineering contributes technical context, legal teams interpret obligations, procurement reviews supplier information, and leadership establishes priorities and accountability.
领导者的切入点 正如 Branson 所言，企业领导者可以从明确谁负责软件供应链风险入手。他们还可以审视该责任如何与现有治理架构相关联。审查用于创建、验证和更新软件清单的方法，可能有助于发现哪些环节需要额外的验证。
Where leaders can start As Branson notes, business leaders can begin by identifying who owns software supply chain risk. They can also look at how that responsibility connects to existing governance structures. Reviewing the methods used to create, validate, and update software inventories may help reveal where additional verification could be useful.
供应商尽职调查还可以纳入关于软件成分、来源和 SBOM 质量的问题。产品生命周期流程可以确立保持这些记录最新的要求。将这些活动与开发速度相协调，可能使治理在团队创建、集成和发布代码时支持创新。
Supplier due diligence can also incorporate questions about software composition, provenance, and SBOM quality. Product lifecycle processes can establish expectations for keeping those records current. Aligning these activities with development speed may allow governance to support innovation as teams create, integrate, and release code.
从根本上说，软件透明度可能为企业提供一个切实可行的基础，以实现韧性、问责制和可持续创新。AI 扩展了团队生产软件的方式，而相互关联的供应链则更深地嵌入组织内部。了解代码成分可以帮助领导者评估机遇和责任。
Essentially, software transparency may offer enterprises a practical foundation for resilience, accountability, and sustainable innovation. AI expands the ways teams can produce software, and interconnected supply chains get embedded more deeply within organizations. Understanding code composition can help leaders evaluate both opportunities and responsibilities.
对 Branson 而言，更宏大的雄心是将软件创建与知情监管联系起来。
For Branson, the broader ambition is to connect software creation with informed oversight.
他表示：“机遇在于将软件供应链完整性置于组织创新方式的核心位置，确保增长战略将代码谱系及其相关义务纳入考量。”将开发能力与对其软件的可靠认知相结合的企业，可能更有利地做出明智决策。这贯穿整个产品生命周期。
He says, “The opportunity is to make software supply chain integrity central to how organizations innovate, ensuring that growth strategies account for code lineage and its associated obligations.”Enterprises that pair development capability with reliable knowledge of their software may be better positioned to make informed decisions. That holds throughout the product lifecycle.