BSIMM15 shines light on compliance and AI security — but updating tooling is key

BSIMM15 outlines three major trends: uncertainty and risk from AI/ML use in development, accelerating compliance-driven supply chain controls (SBOMs, SCA), and declining software security training. Experts argue that modern supply chain threats outpace traditional AppSec (SAST/DAST/SCA) and recommend shift-everywhere governance and binary analysis to detect tampering and malware, while cautioning that culture and education must keep pace. The report reflects practices of more mature organizations and calls for more forward-looking controls, particularly for risks introduced via commercial software.