The SBOM Movement

Software Bills of Materials (SBOMs) are the talk of the town. Whether as an external dependency of a developing product or as a mission-critical tech stack component, inbound software has provenance (and often, vulnerabilities) that need to be reported for security downstream. US and foreign government support and executive action have done much to stir awareness of these supporting docs, which many are ready to embrace as standard—but 2/3ʳᵈˢ or more of organizations still are unaware of new SBOM mandates. The future is bright, but this bit of security literature has a ways to go before mass supply chain adoption.