An SBOM (Software Bill of Materials) is an inventory of software components. It records the names, versions, and origins of open-source and commercial libraries, outsourced code, and other components to show dependencies.
This matters now because connections extend beyond code. Cloud services, SaaS, and contractors access internal systems or sensitive data. Without knowing our dependencies, we cannot identify the weakest links (KCBCA Signals p.20–21).
Creating the inventory is only the beginning. Something true at review may no longer be true today (p.21).
Update the inventory with each deployment and continually check origins and review evidence. A CPS security workshop presentation reported on October 1 also emphasized a system for continually identifying, managing, and sharing components over generation alone (Daily Secu).
What an SBOM records
A software product contains internally written code, AI-generated code, contractors' code, and open-source and commercial libraries (Daily Secu, October 1). Its components are recorded as follows.
| Field | Contents |
|---|---|
| Component name | Which libraries and packages are included |
| Version | Exactly which version is used |
| Supplier and origin | Who created it and where it came from |
| Dependencies | Which components depend on which others |
| Licence | Conditions governing use |
| Identifier and hash | Unique values for checking whether files match |
An inventory makes it possible to identify affected services immediately when a new vulnerability is disclosed (Daily Secu, October 1). It is the starting point for software supply chain security and dependency management.
Map dependencies beyond code
Companies depend on more than packages. Cloud services, SaaS, payment processors, contractors, APIs, open source, and AI tools may access internal systems or sensitive data (p.20). These connections can introduce third-party risk even when internal controls are strong.
Four questions for a dependency map (p.21) 1. What can it access? 2. What data does it handle? 3. What software and services does it introduce? 4. Which operations depend on it?
Attackers need not breach the strongest company directly. They can enter through a small contractor or dependency that already has a trusted access route (p.20).
Check the entry route for external packages
At one research institution, an AI coding agent repeatedly invented a nonexistent package name, and an attacker uploaded a malicious package under that name to a public repository. Subsequent builds fetched it, secretly leaking research materials (p.16–17).
The proposed measure is to prevent unrestricted access to public package repositories by AI coding agents and build pipelines. Route external dependencies through curated private mirrors, verify their origins cryptographically before use, and check package age and behaviour (p.17).
This attack method is discussed in detail in the October 13 article on supply chain attacks.
Reviewed evidence also ages
A dangerous assumption is that something true at review must still be true (p.21). Assessment reports are superseded, certifications expire, and fixed vulnerabilities can reopen. Meanwhile, an organization may still rely on an old PDF (p.21).
SBOMs also need to be regenerated and versioned with deployments and updates. Evidence must be traceable: who supplied it, when it was approved, which version was reviewed, and whether the file subsequently changed (p.21).
Concentration risk when many organizations use the same service
A dependency map also shows whether several companies rely on the same service. If a shared service supplying transaction-verification information is compromised, companies that individually protect their wallets may approve harmful transactions simultaneously. If the same service also handles recovery, their responses may become difficult together (p.33).
In September 2026, a cloud learning management system (LMS) provider was compromised, after which personal information leaks were confirmed at 22 websites using the service (Boannews, September 30).
Identify shared tools and suppliers, and test whether recovery is possible without that service (p.33).
What is established about mandatory SBOMs
The European Union's Cyber Resilience Act (CRA) entered into force on December 10, 2024. Reporting obligations apply from September 11, 2026, and the main obligations from December 11, 2027 (European Commission). Recital 77 explains that manufacturers of products with digital elements should identify and document components, including by drawing up an SBOM (EUR-Lex, Regulation 2024/2847).
Korea's Software Supply Chain Security Guidelines explain component inventory verification, software component management, and supply chain security management based on inventories (Korea Internet & Security Agency, Public Data Portal).
SBOM adoption checklist
| Check | How to verify | Basis |
|---|---|---|
| Dependencies beyond code | Include cloud services, SaaS, outsourcing, APIs, and AI tools in the map | p.20 |
| Package entry routes | Use a private mirror that checks origins instead of fetching directly from public repositories | p.17 |
| Updates at deployment | Regenerate and version the inventory with every deployment | Daily Secu |
| Evidence status | Check superseded reports, expired certifications, and recurring vulnerabilities | p.21 |
| Response to new vulnerabilities | Immediately compare disclosed vulnerabilities with the inventory | Daily Secu |
| Shared dependencies | Test recovery without shared services | p.33 |
| Responsibility | Assign responsibility for updates, verification, and monitoring | p.16 |
Frequently asked questions
Q. Do small companies also need an SBOM?
Even small companies use open source and SaaS and are connected to other companies' supply chains (p.20). Start by recording the components of one core product and updating them with every deployment.
Q. Does having an SBOM alone make software safe?
No. A component inventory shows what is included but does not prove safety.
Recording an evidence history does not guarantee that its contents are true (p.21). Compare it with new vulnerabilities, take action, and update it.
Q. Who should manage it?
Assign responsibility for updates and verification separately from creation. KCBCA Signals proposes assigning responsibility and monitoring at dependency boundaries under board oversight (p.16).
At a glance
- An SBOM is a software component inventory and the starting point for dependency management
- Include cloud services, SaaS, outsourcing, APIs, and AI tools in dependency maps (p.20–21)
- Update inventories with deployments and track evidence expiry and changes (p.21)
- Test recovery without shared services (p.33)
For more on software supply chain security and trust in the AI era, read the KCBCA Signals report.
Read KCBCA Signals Vol.1 Issue 1
References: KCBCA Signals Vol.1 Issue 1; Rob Goehring (CEO, Wisr.ai) p.20–21; Jack Wong (CEO, Scryer; Director, KCBCA GLOBAL) p.16–17; Marc Krisjanous (Founder and Principal Consultant, Zanarc) p.33; Reporting: Daily Secu, October 1 (CPS security workshop, Sparrow division head Yeo Gu-yong), Boannews, September 30; Official materials: European Commission, EUR-Lex 2024/2847, Korea Internet & Security Agency
