Checkmarx AI Supply Chain Security

Checkmarx AI Supply Chain Security is the AI/ML-aware scanner inside the Checkmarx One Supply Chain pillar. It treats AI artifacts the way SCA treats OSS dependencies: model files (PyTorch, TensorFlow, ONNX, GGUF, safetensors), training-data sources, AI inference dependencies (transformers, langchain, llama.cpp, vLLM), and the prompt-engineering surface that connects them. Programs running AI workloads inside customer-facing applications without scanning the AI supply chain are running unscanned production code by another name.

Hugging Face awareness is the marquee capability. The Hugging Face Hub is where most enterprise AI development pulls models from, and Hugging Face artifacts ship with arbitrary code execution surfaces (custom modeling code, pickle-format weights that execute on load, tokenizer config that can run scripts). Checkmarx scans Hugging Face downloads for malicious model artifacts, validates checksums against known-good versions, and flags models that were silently re-uploaded with different content. The pattern is similar to typosquatting but on model namespaces.

Training-data provenance is the harder problem. Where did the data come from, was it licensed for the use case, does it contain regulated PII, and has it been validated against poisoning indicators. Checkmarx surfaces what is known about the provenance from artifact metadata, training-config files, and registered datasets. It does not solve provenance where the answer is not present in the artifact, but it makes the gap visible rather than implicit. Programs that took a shortcut and trained on whatever happened to be in the bucket find out they did during the scan rather than during regulatory review.

What kills AI Supply Chain Security adoption is treating it as an ML-team-only product. The findings need to flow into the same AppSec backlog as SAST and SCA, the policy needs to live with the rest of the AppSec policies, and the developers using AI APIs need the same PR-time visibility they get on SCA findings. Programs that silo AI security under a separate ML governance group end up with two policies, two backlogs, and a gap where they meet. Merito's engagement integrates AI Supply Chain Security into the broader AppSec program from day one.

Merito has worked with programs shipping AI inference services into customer-facing applications while running zero scanning against the model artifacts, the training-data sources, or the AI library dependencies. The reasoning is usually that the ML team owns AI security separately. The reality is that a tampered Hugging Face model that ships pickle weights with arbitrary code execution is a production breach, and AppSec finds out about it through an incident rather than a scanner. AI Supply Chain Security exists because the supply-chain attack surface is real on AI workloads.

Merito recommends AI Supply Chain Security specifically when the program runs production AI workloads from Hugging Face or other model hubs, when training-data provenance matters for regulatory or contractual reasons, and when the AI dependency surface (transformers, langchain, vLLM) is large enough that SCA alone is not sufficient. For programs that consume AI through hosted APIs (OpenAI, Anthropic, Bedrock) without self-hosting models, the supply-chain surface is narrower and AI Supply Chain Security has less to do. Merito surfaces that during scoping rather than overstating the value.

Hugging Face awareness is the marquee capability and the place where most enterprise AI security exposure actually lives. Programs that download models from Hugging Face without checksum validation are running unscanned binaries by another name. Generic SCA tools without ML awareness do not see the layer.