SBOM: articles and guides

Every CycloneDX 1.7 ML-BOM part explained: model card, datasets, RAG and MCP services, signatures. With a field table and a valid worked example file.

SPDX 3.0.1 AIPackage and DatasetPackage fields explained with a worked JSON-LD example, a field table, and the gaps you will hit modelling an AI system.

Exactly what to capture in an AI Bill of Materials (AIBOM) — models, datasets, AI/ML dependencies, configuration, and risk metadata — mapped to CycloneDX ML-BOM and SPDX 3.0 AI Profile, with a copy-paste checklist and the PlayCISO tools to generate and validate one.

An AIBOM inventories the models, data and software that make up an AI system. A step-by-step guide to building one, what to include, and the formats that make it useful.

An ML-BOM (machine learning bill of materials) inventories a system’s models, datasets and provenance, in CycloneDX or SPDX. Versus SBOM and AIBOM.

Attackers publish your private package name to npm or PyPI at a higher version. Stop it with scopes, pinned hashes and one curated proxy such as Artifactory.

AIBOM: a machine-readable inventory of every model, dataset and dependency in an AI system. What it must include, versus an SBOM, and how to generate one.

SBOM vs AIBOM vs MLBOM (ML-BOM, AI SBOM): what each bill of materials inventories, the CycloneDX and SPDX 3.0 formats, and when you need each one.