LiteLLM Supply Chain Compromise: When Your AI Dependency Becomes an Attack Vector
PRISM Discover: AI & Software Discovery
One Defensible Inventory of Every AI and Software Asset You Run
Discover every AI model, autonomous agent, MCP server, and API endpoint — alongside every open-source software component — with governance-ready inventory aligned to ISO 42001, the EU AI Act, NIST AI RMF, and payment regulators (RBI, SAMA, CBUAE, MAS).
WHY IT MATTERS
Every AI audit begins with "Show me your inventory”. The answer to the auditor is usually a stale spreadsheet, and that fails every regulatory requirement.
Shadow AI Across Five Domains
Models, agents, MCP servers, API endpoints, and traditional ML deployed without security oversight. Self-reported inventories miss what nobody disclosed.
Invisible Agents and MCP Trust Chains
Agent permissions, inter-agent communication flows, and MCP server trust chains are invisible to CMDB and ITAM tools - and one over-permissioned agent cascades.
No Governance-Ready Output
Spreadsheets and vendor exports do not align to ISO 42001, EU AI Act, NIST AI RMF, and the payment-sector rulebooks (RBI, SAMA, CBUAE, MAS). Compliance teams reformat by hand before every audit.
Fragmented Risk Assessment
Software risks and AI risks are evaluated separately, leading to incomplete security and compliance views.
Regulatory and Compliance Pressure
Growing expectations around SBOM, AI transparency, and regulations like the EU AI Act increase reporting complexity.
Our Approach
PRISM Discover uses a 4-step approach to analyze a single codebase through two integrated engines, delivering unified visibility across both software supply chains and AI infrastructure.
Catalogue
Inventory AI/LLM models, autonomous agents, MCP servers, API endpoints, and traditional ML — plus every open-source software component and dependency (SBOM/SCA) — across cloud, on-prem, and hybrid.
Map
Surface fine-tuning lineage, agent skills and permissions, inter-agent flows, and MCP server trust chains — and, on the software side, code-level reachability separating exploitable CVEs from noise — depth no CMDB or ITAM can reach.
Verify
Continuous discovery — not a point-in-time export along with built-in supply chain integrity (provenance, signed weights, dependency scan).
Govern
Produce governance-ready AI register aligned to ISO 42001, EU AI Act, NIST AI RMF, CBUAE, SAMA, RBI and MAS — and feed every downstream PRISM module. Discovered detail feeds PRISM Govern’s living register automatically — the Discover → Govern closed loop.
Service Offerings
PRISM Discover delivers one standards-aligned inventory across your software and AI estate — cataloguing models, agents, MCP servers and software components, and securing both the software and AI supply chain
A current SBOM and full software-composition analysis on demand — with reachability that collapses hundreds of “critical” CVEs to the few actually invoked, a composite risk score paired with a fix-cost estimate, a blast-radius graph, licence checks, and daily new-vulnerability alerts. Value on day one, before any AI use case.
Model metadata for AI/LLM models (vendor, version, parameters, fine-tuning lineage), autonomous agents (framework, skills, permissions, inter-agent flows), MCP servers (external integrations, data access, trust chains), API endpoints (model serving, embedding, retrieval, orchestration), traditional ML models (scikit-learn, XGBoost, TensorFlow with dependency and data lineage).
Maps every agent's framework, skills, permissions, and inter-agent communication flows. Identifies every MCP server connected to agents — external integrations, data access, trust chains.
Model provenance verification, signed model weights and checksums, AI library dependency scanning, third-party model risk assessment - built into discovery workflow rather than bolted on separately.
Structured AI asset inventory across all five domains aligned to ISO 42001, EU AI Act, NIST AI RMF, CBUAE, SAMA, RBI, MAS and auditor-ready documentation with outputs in JSON, SPDX and CycloneDX formats (AI BOM, Agent BOM and ML BOM).
BENEFITS
PRISM Discover helps you build transparency across your software and AI ecosystems by cataloguing your entire AI and software estate
Five-Domain AI-Native Inventory
AI/LLM models with fine-tuning lineage, autonomous agents with skills and permissions, MCP servers with trust chains, API endpoints, and traditional ML — all in one register.
Eliminates Shadow AI Blind Spots
Every AI model, agent, MCP server, API endpoint, and ML model is catalogued — not just what was approved.
Unified Visibility
Maps agent frameworks, skills, permissions, and inter-agent communication. Identifies every MCP server connected to agents — external integrations, data access, trust chains.
Stronger Supply Chain Security
Model provenance verification, signed weights and checksums, AI library
dependency scanning, third-party model risk — built into discovery, not bolted
on.
Less CVE Noise, Faster Fixes
Reachability and composite scoring cut hundreds of “critical” findings down to the handful that are genuinely exploitable — each paired with a fix-cost estimate, so teams fix what matters first, and cheapest.
A Living Register, Not a Stale Spreadsheet
Discovered detail feeds PRISM Govern’s living AI register automatically, so governance is never working from a hand-copied inventory that is stale the moment it is produced.
Enhanced Compliance Readiness
Structured AI asset inventory aligned to ISO 42001, EU AI Act, NIST AI RMF, CBUAE, SAMA, RBI, and MAS with auditor-ready documentation.
Why Organizations Choose PRISM Discover from SISA
PRISM Discover unifies SBOM, AIBOM, and compliance evidence to make software and AI supply chain risk visible, actionable, and audit-ready.
Unified SBOM and AIBOM Platform
Combines software supply chain intelligence and AI component discovery in a single solution.
Deep Code-Level Analysis
Uses both manifest parsing and source code scanning to detect dependencies and AI usage accurately.
AI-Specific Visibility and Governance
Identifies AI infrastructure, models, and usage patterns that traditional tools cannot detect.
Standards-Aligned and Future-Ready
Supports SBOM standards like SPDX and CycloneDX while enabling emerging AI governance requirements.
Actionable Risk Intelligence
Provides vulnerability insights, remediation guidance, and lifecycle tracking for both software and AI components.
Designed for Modern Development Environments
Built to support complex, AI-driven applications with scalable and efficient analysis capabilities.
Built for Payments, Not Retrofitted to It
Comes with deep PCI heritage and QSA authority — with native coverage of PCI DSS 4.0.1, PCI SSC AI Principles, RBI, SAMA, CBUAE and MAS, not adjacent frameworks in a long list.
PCI QSA Heritage Embedded in the Product
18+ years as a PCI Qualified Security Assessor is embedded in the audit logging, evidence packaging and control attestation — so discovery outputs land directly in an assessor’s standard workflow.
Closed-Loop by Design (Discover → Govern)
The discovered inventory feeds PRISM Govern’s living register automatically — governance is evidenced by what was actually found, never a stale copy.
Know Every AI and Software Asset in Your Organization
