What Is a Software Bill of Materials (SBOM)?

On this page
  1. What does an SBOM contain?
  2. Why does it matter so much?

A software bill of materials (SBOM) is a complete, machine-readable inventory of every component inside a piece of software — like an ingredients list for an application. It exists because you cannot assess risk in something whose contents you do not know, and modern software is a deep stack of dependencies. When the next widely used library turns out to be vulnerable, an SBOM is the difference between an instant answer and a frantic week of searching.

What does an SBOM contain?#

At minimum, for each component:

  • Name and version of every direct and transitive dependency.
  • Supplier / origin of the component.
  • Relationships — what depends on what.
  • Increasingly, provenance and integrity data (how it was built, and signatures).

The point is transparency: making the invisible dependency tree visible and queryable.

Why does it matter so much?#

Consider the recurring scenario: a critical vulnerability is announced in a popular library, and every organization on earth asks “are we affected, and where?”

Without SBOMWith SBOM
Days of manual searchingA query answered in minutes
Uncertainty about coverageDefinitive inventory
Missed vulnerable instancesComplete visibility

SBOMs turn supply-chain response from guesswork into a lookup, and complement software composition analysis by recording exactly what you shipped.

An SBOM is the inventory that makes supply-chain response possible. More at the Defense & Hardening hub.

Frequently asked questions#

What is a software bill of materials?

An SBOM is a formal, machine-readable inventory of all the components — libraries, dependencies, and their versions — that make up a piece of software, much like an ingredients list on food. It provides transparency into what is actually inside an application, which is the prerequisite for knowing whether you are affected by a newly disclosed vulnerability.

How does an SBOM help during an incident?

When a vulnerability is disclosed in a popular component, the urgent question is "are we affected, and where?" With SBOMs, you can search your inventory and get an answer in minutes. Without them, teams scramble for days trying to determine which of their applications include the vulnerable component. An SBOM turns a fire drill into a query.

Sources & further reading