- Presenting the 'AI-Native Supply Chain Security' paradigm and launching the AIBOM·XBOM expansion technology roadmap

- Implementing an integrated model combining SecuLayer's intelligent vulnerability analysis platform and SK Shieldus's real-world monitoring capabilities

- Sharing the results of the virtuous cycle supply chain security system at the 'IITP Tech & Future Insight Concert 2026'

SecuLayer's roadmap for integrated management and automated response to supply chain threats based on SBOM – Provided by SecuLayer

SecuLayer (CEO Lee Jae-woo), a specialized company in AI-based cybersecurity solutions, announced that it is accelerating the establishment of a software (SW) supply chain security management system in consortium with SK Shieldus as the leading organization for the '2026 SW Supply Chain Security Model Construction Support Project' organized by the Ministry of Science and ICT and the Korea Internet & Security Agency (KISA).

With the recent widespread adoption of open-source and commercial SW packages, supply chain breach threats targeting the entire process of developing and distributing software have sharply increased. Accordingly, major countries around the world, including the United States (EO 14028) and the European Cyber Resilience Act (CRA), are rapidly institutionalizing the mandatory identification and management of potential vulnerabilities in software components through the 'Software Bill of Materials (SBOM)' system.
In South Korea, the introduction of a systematic security model to comply with global regulations and ensure supply chain resilience is urgently needed.

Based on KISA's SW supply chain security guidelines and specialized technical support, this project aims to implement an 'Intelligent SBOM Integrated Management and Automated Response System for Supply Chain Threats'.
The core of this initiative is to automate the entire pipeline from SBOM generation, which systematically manages software component lists, to vulnerability detection, risk assessment, automated response, and post-verification, thereby integrating the management of potential threats in the software supply chain on a single platform.

In this project, SecuLayer will lead the development of AI-based SBOM analysis engine and automated vulnerability response platform technology, while SK Shieldus, equipped with the largest cybersecurity operational capabilities in South Korea, will focus on validating effectiveness and optimizing operational models in real monitoring infrastructure and environments.
Currently, both companies are implementing SBOM and vulnerability linkage analysis, dynamic risk visibility, threat mitigation, and automated reporting systems, and are conducting multifaceted validation assessments linked to real operational environments.
 

In particular, this platform proactively integrates the standard for exchanging vulnerability exploitability information, VEX (Vulnerability Exploitability eXchange). By precisely filtering whether vulnerabilities identified by SBOM can be executed and exploited in actual service environments, it significantly reduces false positives that cause fatigue for security managers and allows for focused allocation of security resources to high-risk vulnerabilities that require immediate response.
 

Additionally, the SBOM and VEX data from the development and supply stages are smoothly transmitted to the operational stage, and the threats identified and mitigation results at the operational and monitoring stages are fed back to the entire development and supply chain, completing a 'bidirectional virtuous cycle security governance'.
Even when new open-source vulnerabilities emerge, the structure allows for real-time tracking of vulnerable assets, verifying their actual impact in the operational environment, and immediately applying response measures to continuously improve the security of the entire supply chain.

Furthermore, SecuLayer plans to leverage this demonstration project as a stepping stone to actively promote the strategy of 'AI Bill of Materials (AIBOM)' managing components and training data of AI models, and expanding the management scope to include data and hardware through an extended Bill of Materials (XBOM), thus advancing the 'AI-Native Supply Chain Security' initiative.

SecuLayer participated in the 'IT Mega Vision X IITP Tech & Future Insight Concert 2026' held on September 16, co-hosted by the Information and Communication Planning Evaluation Institute (IITP) and the Electronic Times, operating an exhibition booth to introduce the current status of this project and the SBOM-based technology roadmap to industry stakeholders, sharing next-generation supply chain security strategies.  

SecuLayer emphasized, "To effectively manage the vast vulnerabilities identified through SBOM (Software Bill of Materials), it is essential to link with VEX (Vulnerability Exploitability Information) that can assess the impact and exploitability in actual operational environments." It explained that it is crucial to go beyond merely identifying the existence of vulnerabilities to selecting risks that require actual response and prioritizing actions.

It further revealed plans to expand the security management scope from existing software to AIBOM (AI Bill of Materials) that enhances transparency of AI models and components, and to gradually expand to XBOM that encompasses the configuration information of software, data, and hardware in the long term.
Through this, it aims to establish 'AI-Native Supply Chain Security' by making AI the core foundation of security and considering security elements comprehensively throughout the supply chain from the design stage.

The consortium plans to complete simulated penetration training and threat response scenario validation based on the real platform within this year and distribute the supply chain security reference model.

 CEO Lee Jae-woo of SecuLayer stated, "This KISA demonstration project is significant in that it presents an effective supply chain security solution by combining SecuLayer's advanced AI data analysis technology with SK Shieldus's extensive operational and monitoring know-how." He emphasized, "We will position this construction model, which combines the monitoring and analysis capabilities of SecuLayer and SK Shieldus, as a best practice that can be expanded across the public, private, and security ecosystem, thereby leading the true 'AI-Native Supply Chain Security' standard that expands to AIBOM and XBOM."