Cycode
Making shadow AI controllable
Cycode is expanding its platform to include an AI inventory and an AI parts list. The aim is for companies to recognize which AI tools, models and assistants developers use throughout the entire software lifecycle, including shadow AI.
The use of artificial intelligence in software development creates a new risk: shadow AI. Developers are turning to new AI models, using different coding assistants and connecting to a variety of AI infrastructures. This creates a vast invisible ecosystem that makes it difficult for security teams to effectively secure AI-generated code.
Cycode's AI inventory aims to eliminate this blind spot. It provides a "single source of truth" for all AI components used in the software development cycle. With the solution, companies can:
- Uncovering shadow AI. The software enables an inventory of all AI assets by automatically detecting when developers use coding assistants, connect to a Model Context Protocol (MPC) server or add AI models. With Cycode's Risk Intelligence Graph (RIG), each asset can be traced back to its source in a code repository.
- Control AI usage. Security teams have the ability to set up controls by defining custom policies. For example, a team can create a list of approved tools and models, and the system will flag any tools that deviate.
- Create AI bill of materials. The software enables the creation of an AI Bill of Materials (AIBOM). This directory lists all AI components used and is updated on an ongoing basis.
The AI Inventory and AI Bill of Materials are an integral part of Cycode's AI-Native Application Security Platform. "We are facing an invisible ecosystem of AI tools that is triggering a wave of risk," explains Jochen Koehler, Vice President of Sales EMEA at Cycode. "It is no longer enough to just find vulnerabilities in AI-generated code. Companies need complete transparency and control over the entire AI tool chain."
Cycode's AI inventory is currently in the early access phase.










