What is Software Bill of Materials (SBOM)?
Software Bill of Materials (SBOM) is a machine-readable inventory that lists every component, library, and dependency included in a piece of software, along with version numbers and licensing information. It gives developers, security teams, and buyers a precise record of what a software product contains.
What it is
An SBOM is a structured document, typically in a standard format such as SPDX, CycloneDX, or SWID, that enumerates:
- Every open source and third-party library bundled in a software artifact
- The version of each component
- The license governing each component
- Dependency relationships between components
- Known identifiers such as CPE or PURL that link components to vulnerability databases
An SBOM can be generated at build time, extracted from a binary, or produced by analyzing source code. It is a fact document, not a risk score. It describes what is present, not whether those components are safe.
Why it matters
A single application can pull in hundreds of transitive dependencies. When a critical vulnerability is disclosed, such as Log4Shell in 2021, organizations without SBOMs had no fast way to answer "do we use this?" An SBOM makes that question answerable in seconds.
Regulators and buyers increasingly require SBOMs. The U.S. Executive Order 14028 on cybersecurity directed federal agencies to require SBOMs from software vendors. The EU Cyber Resilience Act includes similar expectations. Enterprises now ask vendors for SBOMs as part of procurement.
SBOMs also support license compliance. A legal team can check an SBOM to confirm no GPL-licensed code is embedded in a proprietary product before shipping.
How tools address it
Software Composition Analysis (SCA) tools are the primary way teams generate and consume SBOMs. They scan source code, package manifests, or compiled binaries and produce SBOM output in standard formats. Some tools also ingest SBOMs from third-party vendors and flag components with known vulnerabilities or end-of-life status. Mobile app security tools can extract SBOMs from compiled app binaries where source code is unavailable. Software supply chain security platforms often treat the SBOM as a central artifact, linking it to build provenance and signing records.