Ran a 90-day proof-of-concept across our AWS and Azure environments. The AI Inventory and BOM promise is ambitious. Here's what we actually got.
The good:
* Asset discovery is fast. Faster than our legacy tools.
* The "AI" seems to primarily categorize known resources well.
* BOM for container images was accurate when it had direct OS package manager data.
The not-so-good:
* The "bill of materials" for cloud services is just a repackaged asset list with vendor metadata. Don't expect deep CVE mapping for proprietary services.
* Custom or in-house applications? The SBOM generation falls apart. It guesses.
* The criticality scoring is rigid. We had to constantly adjust weights to reflect our actual risk posture.
Biggest pitfall: the data hygiene required. The inventory is only as clean as your cloud resource tagging, which for us was a mess. Garbage in, gospel out.
Bottom line: Useful as a rapid cloud asset inventory tool. Treat the AI-generated BOM for anything beyond standard OSS with extreme skepticism. It's a starting point, not a source of truth.