SBOMs Are Not Enough
devops.com, Friday, July 11th, 2025
Software Bill of Materials (SBOM) is a way to capture the names and versions of all the components used to build an application.
It's a critical tool for software composition analysis (SCA) because it helps us map known vulnerabilities to the components we rely on. Given that 80 to 90% of software application code comes from third-party components, keeping track of these vulnerabilities and updating to patched versions is a vital part of managing the risks these components introduce.
If you ask most SCA vendors, they'll tell you that's the whole game: Track your components, patch when needed and you've got your risk covered. But that's only part of the story. Composition analysis is necessary, but not sufficient. It won't tell you about the vulnerabilities lurking in your third-party components that haven't been reported yet.