Knowing what your software is made of
A Software Bill of Materials (SBOM) is a formal inventory of the components inside a piece of software: direct dependencies, transitive dependencies, versions, and licences. Its purpose is to make it possible to answer a question that used to be surprisingly hard: when a vulnerability is disclosed in a widely used library, which of our applications are affected?
Before SBOMs became routine, that question was often answered by paging developers and hoping they remembered. The Log4Shell response in 2021 made the cost of that approach visible enough to shift the industry.
Why SBOMs are increasingly required
SBOM production has moved from a good practice to a contractual and regulatory expectation. US federal software procurement requires SBOMs. Enterprise buyers ask for them in due diligence. The EU Cyber Resilience Act references them. The direction of travel is clear: if you produce software for anyone else, you will be expected to produce an SBOM alongside it.
Pipeline security
An SBOM only helps if the pipeline that produces the software is trustworthy. If an attacker has compromised the build environment, the SBOM lists the components the source declared, not necessarily the ones that ended up in the artefact.
Pipeline security focuses on protecting the software factory: the source control system, the build agents, the artefact repositories, and the deployment tooling. Practical measures include:
- Signed commits and signed artefacts, so tampering is detectable
- Isolated build environments that do not persist state between runs
- Least-privilege access for build agents and deployment credentials
- Provenance metadata that records how each artefact was built
- Regular audit of the pipeline itself, not just the code it processes
Together, not separately
SBOMs and pipeline security are complementary. The SBOM tells you what is in the software; pipeline security gives you reason to believe the SBOM is accurate. Neither is sufficient alone, and both are increasingly the baseline expectation for anyone shipping software professionally.
Related in the Knowledge Base
- Supply Chain and API Security: The Risk You Inherit
- Secret Management and Container Security: The Basics
- OWASP and the Vulnerability Classes That Won't Die
Know what an attacker sees before they do.
A practical exposure checklist covering the gaps that cause most breaches, plus what POPIA actually requires you to have in place.
Free PDF · No spam · Unsubscribe anytime