A software bill of materials (SBOM) is a formal record of the components, and their supply chain relationships, that make up a piece of software. Most products are assembled from open-source and commercial libraries; an SBOM lists those ingredients so that users know what is inside.

How it works

• For each component, an SBOM records details such as name, supplier, version, unique identifiers and how it relates to other components.
• SBOMs are produced in standard machine-readable formats, most commonly SPDX and CycloneDX, often generated automatically in the build pipeline.
• A nested SBOM also lists dependencies of dependencies, which is where many hidden risks sit.
• Vendors share SBOMs with customers, who match them against vulnerability data.

Why it matters for defenders

When a serious flaw is disclosed in a widely used library, the first question is “where do we use it?”. Without an SBOM, answering can take days or weeks. With one, teams can search their inventory and see at once which products are affected and need a patch. SBOMs support vulnerability management and the defense against supply chain attacks, and governments increasingly expect them from software suppliers. They describe components, not exposure: secrets leaked in public code still need separate checks, such as code exposure monitoring.

Sources: CISA: Software Bill of Materials (SBOM), NIST CSRC Glossary: software bill of materials