Recommended Free Tools
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Audit an AI system as a software-and-artifact supply chain, not just as a list of Python packages. Build a complete inventory of direct and transitive dependencies, frameworks, plugins, datasets, model weights, containers, registries, versions, digests and runtime locations; generate SBOM and AI-BOM records for every release; correlate exact versions with vulnerability intelligence; verify source, hashes, signatures and provenance; then prioritize reachable, exploitable and exposed paths. Rebuild or replace affected components, rescan the result and keep monitoring deployed artifacts for drift.
This approach catches risks that ordinary software composition analysis misses, including a model file that can execute code when loaded, an untracked adapter in a registry, a training dataset with unclear provenance, or a vulnerable library that never appears in a production package manifest. The workflow below turns those checks into repeatable engineering controls.
As an Amazon Associate I earn from qualifying purchases.
What does an AI dependency vulnerability audit cover?
An AI dependency audit covers every component that can influence training, inference, evaluation, deployment or the handling of model artifacts. The unit of analysis is the complete path from source and training data to a running endpoint, including the build systems and registries in between.
At minimum, include:
- Training and inference application code, notebooks and configuration.
- Machine-learning frameworks, language runtimes, operating-system packages and direct or transitive libraries.
- Plugins, extensions, adapters, tokenizers, evaluation harnesses and orchestration pipelines.
- Datasets, preprocessing code, feature stores and data-conversion utilities.
- Model weights, checkpoints, serialized objects, prompt or policy files and model metadata.
- Container images, base images, package indexes, model registries, artifact stores and CI runners.
- Production hosts, inference servers, batch jobs and any development environment able to publish an artifact.
The audit must also identify trust boundaries: where an untrusted model, package, dataset or serialized object can enter; which identity can publish or replace it; and which process will load or execute it. NIST SP 800-218A (2024) specifically calls for provenance tracking for AI models and components, including training libraries, frameworks and pipelines.
#1 Best Overall
How do I set scope and map trust boundaries?
Start with a data-flow diagram that follows artifacts and credentials, rather than drawing only application boxes. Mark every ingress, transformation, storage location and execution point.
1. Map the lifecycle
- Develop: list source repositories, notebooks, local environments and developer credentials that can add dependencies or upload models.
- Train and fine-tune: record data sources, preprocessing jobs, training libraries, base checkpoints, adapters, experiment trackers and output locations.
- Build: identify package indexes, container builders, CI runners, signing services and the exact files copied into release images.
- Distribute: document model registries, container registries, mirrors, caches and promotion steps between environments.
- Deploy and run: map inference hosts, sidecars, plugins, mounted volumes, network egress and identities with permission to fetch or load artifacts.
2. Mark dangerous crossings
Flag any path where an external contributor, public registry, customer upload, automated downloader or shared storage can introduce an artifact. A model that is safe in a sandbox may become a production risk when a privileged service loads it. Record the loader, process identity, network access and secrets available at each crossing.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute3. Define audit boundaries in writing
State whether the review includes development-only notebooks, temporary experiments, archived models and third-party evaluation services. Excluding an environment is acceptable only when you document why it cannot publish to, alter or execute production artifacts.
How do I build a complete inventory?
Create one authoritative inventory and give every component a stable identity. A package name without an ecosystem, exact version and digest is not sufficient for reliable matching or rollback.
| Inventory field | What to record | Why it matters |
|---|---|---|
| Identity | Package, framework, model, dataset, container or pipeline name; ecosystem; namespace; and format | Prevents collisions between similarly named artifacts and enables advisory matching |
| Version and digest | Exact version, immutable content digest and, where relevant, commit or checkpoint identifier | Shows precisely what was built and lets you reproduce or revoke it |
| Relationship | Direct or transitive dependency; parent image; base model; adapter; dataset or preprocessing dependency | Reveals hidden paths and clarifies who can remove or upgrade the component |
| Ownership | Technical owner, approving team, contact and business service | Turns a finding into an actionable assignment |
| Source and provenance | Registry or repository, publisher, acquisition date, build or training run, attestation and signer | Supports authenticity checks and incident reconstruction |
| Execution context | Runtime image, host or cluster, environment, loader and deployment location | Enables reachability and exposure analysis |
| License and usage terms | Declared license, data-use restrictions and approval status | Separates security remediation from legal or policy decisions |
Capture the inventory from lockfiles and manifests, container layers, build outputs, model-registry metadata, training-run records and deployment configuration. Reconcile those sources: a package present in a lockfile but absent from the built image is different from one installed at runtime, and a model referenced by a configuration file may be fetched after deployment. Preserve the original evidence with the release so later investigators can distinguish a changed artifact from a changed record.
What is the difference between an SBOM and an AI-BOM?
An SBOM describes software components and relationships; an AI-BOM supplements it with machine-learning artifacts and lifecycle context. Use both, in machine-readable form, and attach the records to every release rather than generating a document only during an annual review.
SBOM contents
- Application, operating-system and container packages, including transitive dependencies.
- Component identifiers, versions, licenses, suppliers, relationships and cryptographic hashes.
- Build metadata, dependency scope and the image or release that contains each component.
AI-BOM additions
- Model weights, checkpoints, model format, tokenizer and inference runtime.
- Training and fine-tuning libraries, frameworks, adapters, evaluation code and orchestration pipelines.
- Datasets, data-preparation stages, source or collection method, version and permitted use.
- Training run, base model, hyperparameter or configuration reference, artifact signer and provenance attestation.
SPDX and CycloneDX are suitable machine-readable SBOM families; whichever format you choose, define how AI-specific fields are represented and keep the convention consistent. CISA and G7 partners’ 2025 AI SBOM guidance emphasizes supplemental elements beyond a general software inventory. OWASP AISVS C06 likewise points to completeness checks and signed AI-BOMs.
Rank #2
Make changes reviewable
Store the SBOM and AI-BOM beside the release manifest, sign them, and retain the exact files used for deployment. Diff records in pull requests and deployment events. A review should show additions, removals, version changes, digest changes, ownership changes and provenance changes, not merely a new timestamp.
How do I match components to known vulnerabilities?
Normalize each inventory entry before matching it against CVE/NVD, OSV and relevant vendor advisories. Matching only on a display name creates both false positives and missed findings; use ecosystem-aware identifiers, exact versions and content digests where available.
Record the finding, not just the score
For each advisory, retain the affected version range, fixed version, vulnerable function or module, exploit status, publication and update dates, and the evidence used to identify the component. Note whether the vulnerable code is actually present in the built artifact and whether the vulnerable function can be reached in your configuration.
Check reachability and execution
A vulnerable transitive package in a development notebook is not equivalent to the same package imported by an internet-facing inference service. Trace imports, plugin registration, optional features, network routes and privilege boundaries. For model artifacts, determine whether the file is parsed, deserialized, converted or executed, and by which process.
Handle uncertain matches explicitly
When a package has an ambiguous name, record the candidate identifiers and resolve them with the supplier, lockfile or digest. If an advisory does not identify a model, dataset or plugin format precisely, treat the match as an investigation task rather than silently marking it safe. Keep the analyst’s conclusion and supporting evidence with the finding.
How do I verify model and package integrity?
Allow artifacts into the build only from approved sources and only after integrity and provenance checks pass. Exact-version pinning, hashes, signatures and attestations work together; none substitutes for the others.
- Restrict acquisition: maintain an allowlist of registries, repositories, mirrors and publishers. Block direct downloads from unknown locations in CI and production.
- Pin content: require exact package versions, immutable model or container digests and a recorded dataset or checkpoint version. Avoid floating tags for release inputs.
- Verify hashes: calculate the digest of the downloaded file or image and compare it with the approved value before unpacking or loading.
- Verify signatures: check the signer against an owned trust store and reject expired, revoked or unknown signatures according to policy.
- Validate provenance: require an attestation describing how the package, image, model or dataset was built or trained, which inputs were used and which identity approved it.
- Sign the inventory: sign the SBOM and AI-BOM together with the release so an attacker cannot substitute a clean-looking inventory for a changed artifact.
- Quarantine failures: hold missing, invalid or contradictory provenance in a non-production location for review; do not allow an emergency bypass to become permanent.
Integrity proves that the file is the approved file. It does not prove that the approved file is free of vulnerabilities or malicious behavior, so continue with advisory correlation, static scanning and runtime controls.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →How should I prioritize findings?
Use severity as a starting point, then adjust for reachability, exploitability, exposure, privilege and unsafe loading. A lower-severity issue on an exposed, privileged inference path can deserve faster action than a higher-severity issue in an unreachable build tool.
| Factor | Questions to answer | Priority signal |
|---|---|---|
| Severity | How damaging is the advisory under its stated conditions? | Use the published severity and affected-version scope, without treating it as the final decision |
| Reachability | Can deployed code invoke the vulnerable function or loader? | Reachable execution outranks code that is present but demonstrably unused |
| Exploitability | Is exploit code known, practical or dependent on an unusual precondition? | Known or low-effort exploitation accelerates remediation |
| Exposure | Is the service internet-facing, customer-accessible, multi-tenant or isolated? | Public and cross-tenant paths receive priority |
| Privilege | What identities, secrets, files or network actions can the process access? | Administrative or signing access increases impact |
| Unsafe loading | Can a model or serialized object execute code, alter a loader or trigger a vulnerable parser? | Any untrusted input to a privileged loader is an urgent path |
| Compensating controls | Are sandboxing, egress restrictions, authentication or isolation reliably enforced? | Controls may reduce but should not erase the finding; verify them continuously |
Document the reasoning and the owner for every disposition. “Not exploitable” should identify the blocked route or configuration evidence, not merely repeat an analyst’s opinion. Re-evaluate the decision when the component, deployment, advisory or threat context changes.
What is the correct remediation sequence?
Remediate the artifact that will actually run, then prove that the fix survived the build and deployment process.
- Contain: stop promotion of the affected release, restrict exposure or disable the vulnerable feature when immediate exploitation is plausible.
- Choose a fix: upgrade to a fixed version, replace the component, remove an unused dependency or move to a trusted model or dataset. Record compatibility and license effects.
- Rebuild from trusted inputs: regenerate the container or package set rather than editing a running host. Reacquire model and dataset artifacts through the approved, verified path.
- Retest: run unit, integration, inference, data-quality and security tests that exercise the affected function or loader. Confirm that signatures, digests and attestations are regenerated for the new release.
- Rescan: produce fresh SBOM and AI-BOM records, rerun software-composition and artifact scans, and verify that the vulnerable version is absent from every layer and runtime location.
- Deploy and observe: promote through the normal gate, monitor errors and access patterns, and keep the prior known-good release available for rollback.
- Close the record: attach the fixed version, test evidence, deployment time, approver and any residual risk to the original finding.
When no fix is available
Use a time-limited exception with a named owner, business justification, affected artifacts, compensating controls, review date and explicit expiry. Examples of compensating controls include removing public exposure, disabling a risky loader, running the component in a tightly isolated sandbox or blocking untrusted inputs. An exception is a tracked risk decision, not a substitute for monitoring advisories and supplier updates.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchHow do I operate the audit continuously?
AI dependencies change outside normal application releases: a registry tag can move, a model can be replaced, an advisory can be updated and a base image can acquire a new package. Continuous operation detects that drift.
- Run dependency and artifact inventory jobs in CI/CD and on a schedule for deployed images and model registries.
- Gate releases on complete, signed SBOM and AI-BOM records; fail when a required digest, owner, provenance statement or signature is missing.
- Rescan production images, model stores and caches, not just source manifests.
- Watch CVE/NVD, OSV and supplier advisories for newly affected versions and changed exploit status.
- Alert on digest changes, mutable tags, unexpected registry sources, new transitive dependencies, unapproved model formats and provenance breaks.
- Retain a tested rollback to a known-good package, image and model combination, including the matching inventory records.
- Review access to publish, sign, promote and load artifacts; remove unused credentials and separate those duties where practical.
Useful operating measurements
Track inventory coverage by repository, image, registry and runtime; the percentage of releases with signed records; time from advisory publication to triage and remediation; the age and expiry of exceptions; and the number of deployed artifacts whose digest differs from the approved release. These measures show whether controls work in production instead of merely proving that a scan ran.
Which capabilities should an audit toolchain provide?
No single scanner reliably covers package code, model files, datasets, registries and provenance. Evaluate a toolchain against the actual AI lifecycle and require evidence that each control works in your deployment model.
Rank #4
| Capability | Baseline requirement | Questions for evaluation |
|---|---|---|
| Ecosystem and ML coverage | Recognizes language packages, OS layers, containers and common ML frameworks | Does it identify direct and transitive packages, plugins, adapters, datasets and model metadata? |
| Vulnerability intelligence | Correlates versions with CVE/NVD, OSV and supplier advisories | Does it show affected functions, fixed versions, exploit status and advisory history? |
| Reachability | Separates present components from executable paths | Can it trace imports, optional features, loaders and runtime configuration, and show its evidence? |
| SBOM and AI-BOM | Exports machine-readable SPDX or CycloneDX-compatible records | Can it represent weights, datasets, adapters, training pipelines, relationships, signatures and diffs? |
| Model-file scanning | Inspects model packages and serialized objects before loading | Does it detect malicious code, unsafe parsers, unexpected files and format-policy violations? |
| Registry controls | Supports allowlists, quarantine, immutable references and access logging | Can it prevent unapproved downloads and detect mutable-tag or digest drift? |
| Provenance and signatures | Verifies hashes, signatures and attestations | Can policy reject unknown signers, expired credentials or incomplete build and training provenance? |
| CI/CD integration | Runs on pull requests, builds and deployment events | Are gates configurable by reachability, exposure, privilege and exception status? |
| Remediation guidance | Shows upgrade, replacement and affected-runtime context | Can owners see which releases, images and models must change and whether the fix is present? |
| Privacy and deployment | Supports the organization’s data-handling and network requirements | Can scans run locally or in a controlled tenant without uploading proprietary code, weights or datasets? |
| Rollback and audit trail | Retains prior records and deployment evidence | Can the team restore a known-good artifact and prove exactly what was restored? |
| Operating cost | Prices scanning, storage, registry and analyst workload together | What is charged per developer, scan, artifact, runtime or retained history, and what is needed to operate it? |
What should an implementation plan look like?
A staged plan reduces blind spots without waiting for a perfect platform.
Stage 1: establish ownership and a minimum inventory
- Appoint an owner for each repository, image, model, dataset and registry.
- Require exact versions and digests for new releases.
- Export an initial SBOM and AI-BOM for the highest-impact production services.
Stage 2: enforce acquisition and release gates
- Define approved sources, signer identities, hash requirements and provenance fields.
- Fail builds with missing inventories, invalid signatures, unknown sources or disallowed model formats.
- Send findings to owners with the affected release and runtime location attached.
Stage 3: add risk-aware triage
- Connect advisory matches to reachability, exposure, privilege and loader evidence.
- Set response targets by risk class and require expiry dates for exceptions.
- Test the remediation path from upgrade through rescan and deployment.
Stage 4: cover drift and recovery
- Rescan registries, images and hosts on a schedule and after advisory updates.
- Alert on unauthorized digest or provenance changes.
- Exercise rollback using the retained artifact and signed inventory, not an unverified cache.
What commonly goes wrong, and how do I fix it?
Only direct dependencies are inventoried
Symptom: the manifest looks clean, but a transitive package or base-image layer carries the vulnerable code. Fix: resolve the full dependency graph and scan the built image and runtime environment.
Models are treated as data rather than executable inputs
Symptom: package scanning passes while an untrusted serialized object reaches a privileged loader. Fix: inventory model formats and loaders, scan files before loading, restrict sources and isolate the loading process.
A signed inventory describes a different artifact
Symptom: the SBOM is validly signed but its digest does not match the deployed image or model. Fix: bind the inventory signature to the exact release digest and verify that binding at promotion and runtime.
Severity is used as the whole decision
Symptom: teams spend time on unreachable build findings while an exposed, reachable path waits. Fix: add exploitability, reachability, exposure, privilege and unsafe-loading evidence to triage.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Exceptions never expire
Symptom: a temporary bypass becomes the permanent supply chain. Fix: require an owner, compensating controls, review date and automatic escalation when the expiry passes.
Scanning stops after deployment
Symptom: a model registry tag or container layer changes without a new release event. Fix: monitor deployed digests and rescan registries, caches and hosts continuously.
Best Value
Which standards help define the control set?
Use standards as a control vocabulary, then adapt implementation to your architecture.
- NIST SP 800-218, Secure Software Development Framework (2022): its central rationale is that following SSDF practices should reduce vulnerabilities in released software, limit the impact of undetected or unaddressed flaws and address root causes to prevent recurrence.
- NIST SP 800-218A (2024): extends the profile for AI development and calls for provenance tracking across models and components, including training libraries, frameworks and pipelines.
- CISA/G7 AI SBOM guidance (2025): identifies AI-specific inventory elements that supplement a conventional software bill of materials.
- OWASP AISVS C06: current project guidance includes malicious-code scanning, approved sources, integrity verification, signed AI-BOMs and completeness checks.
These references do not replace engineering evidence. A compliant-looking document is not enough unless it identifies the exact artifact, the trust decision, the deployed location and the action taken when a check fails.
Frequently Asked Questions
Can an SBOM prove that a model is safe?
No. An SBOM establishes what was present and how components relate; it does not prove model behavior, training-data quality or the absence of malicious content. Pair it with provenance, signature verification, model-file scanning, loader isolation and tests that exercise the deployed path.
What should I do when a model or dataset has no CVE?
Treat the absence of a CVE as missing vulnerability intelligence, not as a clean bill of health. Require an identified publisher, immutable digest, usage terms, provenance and integrity evidence, then apply format scanning, access controls and behavioral or data-quality review appropriate to the artifact.
Should development notebooks be included if they never run in production?
Include them when they can publish packages, models, datasets or configuration consumed by production, or when they use privileged credentials. A genuinely isolated notebook can be classified as lower risk, but keep the boundary and the evidence that prevents promotion into the inventory record.
How often should an AI dependency inventory be refreshed?
Refresh it on every build and deployment, whenever a registry artifact or digest changes, and when vulnerability intelligence is updated. Scheduled rescans of deployed images, model registries and caches catch changes that do not create a normal source-code release.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
