What Is a Software Bill of Materials (SBOM)?
A software bill of materials (SBOM) is a complete, machine-readable inventory of every component inside a piece of software — like an ingredients list for an application. It exists because you cannot assess risk in something whose contents you do not know, and modern software is a deep stack of dependencies. When the next widely used library turns out to be vulnerable, an SBOM is the difference between an instant answer and a frantic week of searching.
What does an SBOM contain?#
At minimum, for each component:
- Name and version of every direct and transitive dependency.
- Supplier / origin of the component.
- Relationships — what depends on what.
- Increasingly, provenance and integrity data (how it was built, and signatures).
The point is transparency: making the invisible dependency tree visible and queryable.
Why does it matter so much?#
Consider the recurring scenario: a critical vulnerability is announced in a popular library, and every organization on earth asks “are we affected, and where?”
| Without SBOM | With SBOM |
|---|---|
| Days of manual searching | A query answered in minutes |
| Uncertainty about coverage | Definitive inventory |
| Missed vulnerable instances | Complete visibility |
SBOMs turn supply-chain response from guesswork into a lookup, and complement software composition analysis by recording exactly what you shipped.
An SBOM is the inventory that makes supply-chain response possible. More at the Defense & Hardening hub.
Frequently asked questions#
What is a software bill of materials?
An SBOM is a formal, machine-readable inventory of all the components — libraries, dependencies, and their versions — that make up a piece of software, much like an ingredients list on food. It provides transparency into what is actually inside an application, which is the prerequisite for knowing whether you are affected by a newly disclosed vulnerability.
How does an SBOM help during an incident?
When a vulnerability is disclosed in a popular component, the urgent question is "are we affected, and where?" With SBOMs, you can search your inventory and get an answer in minutes. Without them, teams scramble for days trying to determine which of their applications include the vulnerable component. An SBOM turns a fire drill into a query.