Solving the AI Accountability Crisis in the Software Supply Chain
summary
Claims that AI creates a 10x code volume surge and a 300% rise in supply‑chain attacks, with almost 80% of compliance issues found post‑deploy, drive a demo showing how JFrog binds Sonar scan results and SBOM data as immutable evidence to binaries, enforces Rego policy gates in CI/CD, and records metadata plus an audit timeline. A release without Sonar attestation is blocked; a version with signed Sonar evidence and fixed dependencies promotes to production.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 0:52AI Development Speed Creates a Tsunami of Code
- 1:36Three Forces Colliding in Modern Software Delivery
- 2:31Delivery Bottleneck: Context, Evidence, and Trust
- 3:29Evolution from Manual Release Checks to DevOps Automation
- 3:55Immutable Evidence for Trusted Software Releases
- 4:21JFrog Trust Platform: Three Core Pillars of Software Integrity
- 5:18Demo: Proving Software Trust with Evidence
- 5:34Application View: Business Context at Scale
- 6:01Lifecycle View: Governed Stage Promotion in CI/CD Pipelines
- 6:53Release Gates with Sonar Policy and Code Quality Checks
- 7:31Custom Security Policies Using Rego Policy-as-Code
- 7:46Version Metadata and Audit Timeline for Releases
- 8:25SBOM Analysis and Dependency Graph Visibility
- 8:55Missing Sonar Evidence Blocking a Release Gate
- 9:30Fixed Version Passing Release with Verified Evidence
- 10:02Trusted Software Release Without Manual Overhead
- 10:26Benefit One: Risk-Based Lifecycle Governance
- 10:41Benefit Two: Immutable Audit Evidence for Compliance
- 11:02Benefit Three: Policy-as-Code for Automated Security Governance
related talks
32mReimagining Trust in Software Releases: A New Approach to Supply Chain Integrity (Part 2)
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?
35mManaging the AI Surge: Governing & Scaling in the AI Era
29mManaging the AI Surge
33mSecuring the AI Surge
25mYour Software Supply Chain is Only as Secure as its Weakest Link
16mControl. Shift. Deliver. Take Command of your Software Supply Chain
58mSecuring Code in the Age of AI