Software Technologies Inventory and Attributes

Applications. Applications are built on, deployed on, and depend upon software technologies, so the flow runs from this inventory outward: an application record references the technologies it requires, and a technology record carries the set of applications dependent on it. This is the relationship that makes end-of-support exposure actionable — without it, knowing a database engine loses support tells the enterprise nothing about what breaks. The relationship is carried by dependency attributes on both sides and is the single most consequential link this inventory maintains.

Vendors. Every commercially supplied software technology originates with a vendor, so this inventory consumes from the Vendors Inventory: the supplying vendor is recorded as a relationship attribute on the technology, not restated as vendor data here. Support terms, vendor risk posture, and vendor viability are governed there and referenced from here. Open source technologies invert the pattern — they have a governing community or foundation rather than a vendor, and the attribute records that distinction explicitly rather than leaving it blank.

AI Agents. AI agents are built on and run within machine learning frameworks, model-serving software, and acceleration libraries — all governed here as Artificial Intelligence and Machine Learning Software. The flow runs outward: an agent record references the technologies it depends on, and those technologies carry the agents running on them. This is what lets an enterprise answer which of its governed agents are exposed when a framework vulnerability is disclosed, and it is the connective tissue between technology governance and AI governance.

Integrations. Message brokers, integration middleware, extract-transformation-and-load software, and application programming interface gateways are the technologies through which governed integrations actually run, so the relationship is a cross-reference rather than a dependency in either direction: an integration record names the technologies carrying it, and a technology record carries the integrations that traverse it. This is what makes integration risk traceable to the technology layer — an ageing message broker is an integration risk, not merely a technology one.

Data and Information. Database, data warehouse, and data platform software are the technologies through which governed data assets are stored, served, and moved. The flow runs outward from this inventory: a data asset record names the technology managing it, and a technology record carries the data assets it holds. This relationship is what connects data classification to technology governance — a database holding regulated data inherits obligations that the technology record must reflect.