Why SBOMs, signing, and provenance still don’t tell you if software is safe

The report argues that modern software supply chain security—SBOMs, signing, and provenance—improves visibility and integrity but does not determine what code will do at runtime; with AI generating and adapting code (including research demonstrating an AI-powered worm), organizations must add behavioral verification and a "Zero Trust for Code" approach to assess actions like privilege escalation, persistence, credential access, and unexpected network communications before execution.