Overview
The OWASP AIBOM Call #17 focused on Phase 3 execution, progress across the project workstreams, and continued expansion of the community, sponsorships, and external collaboration.
Major updates included continued development of the AIBOM 101 guide, progress in the Policy and Threat Intelligence workstreams, and the announcement of the new Agentic BOM (AgBOM) workstream. The team also reviewed upcoming LinkedIn Live sessions, the planned Prediction Guard workshop during DEF CON week, conference participation, and ongoing sponsorship efforts.
Action Items
Complete final review and design work for the AIBOM 101 guide.
Prepare AIBOM 101 for internal release and transition to the content team for public publication.
Continue development of the Policy workstream’s first regulatory guidance release.
Launch the new AgBOM workstream and recruit contributors.
Continue Threat Intelligence alignment with Foundations, Policy, and AgBOM.
Promote the upcoming Prediction Guard LinkedIn Live and DEF CON workshop.
Continue planning future sponsor LinkedIn Live sessions.
Expand conference participation and CFP tracking.
Continue sponsorship and collaboration outreach.
Outline
Project Growth and Phase 3
The project continues to grow across LinkedIn, Slack, contributors, and sponsors.
Five sponsors were active at the time of the call.
Phase 3 is focused on:
Workstream execution
Deliverable releases
Clearer workstream goals
Stronger collaboration with open-source projects
Phase 4 will focus more heavily on amplification later in 2026.
AIBOM 101 – Foundations Workstream
The AIBOM 101 guide was in the final stages of development.
Remaining work included:
Graphics and cover design
Consistent terminology
Editing for concise practitioner-focused guidance
Cross-section review
The guide is intended to help practitioners quickly understand and operationalize AIBOM.
An internal release was targeted for July, followed by handoff to the content and social media team for public release.
Additional independent reviewers were encouraged to participate.
Policy Workstream
The first Policy release was narrowed to approximately 10 relevant regulations and guidance frameworks.
Work on the EU AI Act was largely complete.
The team was developing a standardized format for mapping regulatory requirements to AIBOM.
Region-specific guidance from areas such as the United States, Singapore, and Saudi Arabia was also being considered.
An initial release was targeted for around August.
Threat Intelligence Workstream
Threat Intelligence continued working closely with the Foundations and Policy workstreams.
The team planned to use AIBOM definitions and regulatory guidance as the foundation for future threat-intelligence structure.
The new AgBOM workstream was also expected to become an important input.
Collaboration with other open-source projects was encouraged to avoid duplicating existing work.
New Agentic BOM (AgBOM) Workstream
The project announced a new Agentic BOM (AgBOM) workstream.
The goal is to create a standardized, machine-readable inventory for agentic AI systems.
AgBOM is intended to capture:
Agents
Tools and permissions
Models
MCP servers
Memory
Orchestration
Relationships between agents
The workstream aims to improve visibility, supply-chain security, and risk assessment for agentic systems.
Initial work will focus on:
Defining scope
Reviewing existing approaches
Building the working group
Establishing foundational requirements
The longer-term goal is to publish an initial version and move toward a 1.0 release with implementation guidance by 2027.
Contributors were invited to join through Slack.
Content and Engagement
The project continued expanding sponsor-focused LinkedIn Live sessions.
Recent activity included a LinkedIn Live with Manifest Cyber.
A Prediction Guard LinkedIn Live was planned for July 22 to help promote the upcoming DEF CON workshop.
A future session with Codacy was also being planned.
The content strategy includes:
Sponsor visibility
AIBOM awareness
Educational content
Event promotion
Contributors were encouraged to repost and share project content through their own networks.
DEF CON Workshop
Prediction Guard and OWASP AIBOM were planning an in-person workshop during DEF CON week.
The workshop was expected to demonstrate:
Practical AIBOM examples
AI system components
Findings generated from AIBOM-related analysis
The July LinkedIn Live was intended to help build awareness and drive attendance.
Workshop logistics and technical details were still being finalized.
Conferences and Collaboration
The project continues to track conferences and CFP opportunities.
Community members were encouraged to submit additional conferences where AIBOM could be represented.
Upcoming conference participation included events in:
Budapest
Lisbon
Collaboration efforts continue with:
Universities
Industry partners
Open-source communities
Other standards and security projects
Sponsorship
Sponsorship efforts continued across Gold and Silver tiers.
Community members were encouraged to introduce organizations interested in supporting:
AIBOM
AI security
Agentic AI
Sponsorship funding supports project operations, conference participation, and broader awareness efforts.
Community Contributions
Several participants volunteered to contribute practical experience and review work.
Areas of interest included:
ISO 42001
EU AI Act mapping
Enterprise AIBOM implementation
CI/CD-based AIBOM generation
Foundations review
New contributors were encouraged to join the relevant Slack workstream channels.
Final Remarks
AIBOM 101 was approaching final review.
Policy and Threat Intelligence work continued to mature.
The AgBOM workstream officially entered its foundation stage.
Content and event activity was increasingly focused on the upcoming Prediction Guard workshop and LinkedIn Live.
The project continued to expand through contributors, sponsorships, conferences, and external collaboration.
