SBOM

A formal inventory of everything that makes up the artifact: dependencies, versions, licenses and hashes.

SyftCycloneDXSPDX

What it is

An (Software Bill of Materials) is the equivalent of a food's nutrition label: a structured document listing all the components that make up a software artifact: direct and transitive dependencies, exact versions, licenses and cryptographic hashes.

A real SBOM

The two dominant standards are CycloneDX and SPDX. A real excerpt from a CycloneDX SBOM, reduced to a single component:

bom.cdx.json (CycloneDX)json

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "components": [
    {
      "type": "library",
      "name": "lodash",
      "version": "4.17.15",
      "purl": "pkg:npm/lodash@4.17.15",
      "hashes": [{ "alg": "SHA-256", "content": "3d0a2c..." }]
    }
  ]
}

Anatomy of an entry

The purl () is the component's universal identifier: pkg:npm/lodash@4.17.15 states the ecosystem, the name and the exact version, in a format any system can query. The hashes prove the component is exactly what the SBOM says it is, leaving no room for a silent swap.

In practice, the SBOM is generated in the pipeline's package stage, by tools or dedicated generators like Syft, and published (ideally signed) alongside the artifact.

Why it matters: the next Log4Shell test

When the next critical vulnerability breaks in a popular library, the question is always the same: are we affected? With an SBOM, the answer comes in minutes: a search for the purl across the inventory of all services. Without one, it takes days digging project by project, or worse: finding out in production.

It has also become a market requirement: US government agencies began requiring SBOMs from software vendors, and enterprise customers are following the same path.

Relationship with SCA

SCA and SBOM feed each other: composition analysis produces the inventory, and the inventory is what allows continuously monitoring the components against new CVEs. An SBOM generated once and forgotten ages fast: the value is in the living cycle: generate on every build, monitor always.

SBOMThe software's ingredient list: dependencies, versions, licenses and hashes, in a standard format.see in glossary →purlpackage urlA universal package identifier: pkg:npm/lodash@4.17.15 states ecosystem, name and version unambiguously. It is the backbone of an SBOM.see in glossary →SCAComposition analysis: inventories third-party dependencies and cross-references them with known CVEs.see in glossary →

connections on the map

SCAproducesSBOM

updated on 14/10/2026 · sources to go deeper · report an error

in other domains

Third-party and supply chain riskgrcthe inventory that makes vendor assessment concrete
A03 Software Supply Chain Failuresowaspthe inventory that answers "are we affected?"
Containers - images and supply chaincloudsecinventories what goes inside the image

Study before

test what you learned

Loading questions…