Software supply chain attacks compromise an upstream component — such as a widely-used library, a build tool, or a distribution channel — in order to simultaneously affect all downstream users of that component. High-profile incidents such as the SolarWinds attack illustrated the scale and reach of such attacks. Researchers have catalogued the attack surface into a taxonomy covering all stages from source-code contribution to package distribution, linking attack vectors to real-world incidents and corresponding safeguards.[5]
Another important concept in software supply chains is provenance: signed attestations can record where a software artifact came from, which source and dependencies were used, and which steps in the build pipeline produced it. Provenance frameworks such as in-toto help downstream users verify that a release was built by an expected process and help detect tampering between source retrieval, build, and distribution.[6]
Usage
An SBOM allows builders to make sure open-source and third-party software components are up to date and respond quickly to new vulnerabilities.[7] Buyers and other stakeholders can use an SBOM to perform vulnerability or license analysis, which can be used to evaluate and manage risk in a product.[8][9][10]
While many companies use a spreadsheet for general BOM management, there are additional risks and issues in an SBOM written to a spreadsheet, such as the inability to automatically enrich it with vulnerability data or integrate it into security toolchains.[11] It is best practice for SBOMs to be collectively stored in a repository that can be part of other automation systems and easily queried by other applications.[12]
Cybersecurity transparency studies, including TRACS 2025, identify the availability of SBOMs as one of the criteria used when purchasing information security solutions.[13] However, not all enterprise security products provide publicly available SBOMs. Research on open-source ecosystems indicates that policy-driven SBOMs remain rare in practice: one large-scale study found that only about 0.56% of popular GitHub repositories contain SBOMs created in accordance with formal security or compliance policies.[14] Also, according to other research, fewer than half of tested software projects include SBOMs in their releases, and many of those SBOMs are incomplete or do not fully conform to established standards.[15] At the same time, corporate-level surveys report that approximately 60–76% of enterprises require SBOMs from suppliers or have integrated SBOMs into procurement and supply-chain risk management processes.[16]
Legislation
The Cyber Supply Chain Management and Transparency Act of 2014[17] was a failed piece of US legislation (bill) that proposed to require government agencies to obtain SBOMs for any new products they purchase and to obtain SBOMs for "any software, firmware, or product in use by the United States Government". The act spurred later legislation such as "Internet of Things Cybersecurity Improvement Act of 2017."[18][19]
US President Joe Biden’s Executive Order 14028 on Improving the Nation’s Cybersecurity of May 12, 2021 ordered NIST and NTIA to lay down guidelines for software supply chain management, including for SBOMs.[20] The NTIA outlines three broad categories of minimum elements of SBOMs: data fields (baseline information about each software component), automation support (the ability to generate SBOMs in machine- and human-readable formats), and practices and processes (how and when organizations should generate SBOMs).[21] The "automation support" requirement specifies the need for "automatic generation," which is possible with the use of Software Composition Analysis (SCA) solutions.[22]
↑Fucci, Davide; Di Penta, Massimiliano; Romano, Simone; Scanniello, Giuseppe (2025). "Augmenting Software Bills of Materials with Software Vulnerability Description: A Preliminary Study on GitHub". Proceedings of the 33rd ACM International Conference on the Foundations of Software Engineering. pp.631–635. doi:10.1145/3696630.3728513. ISBN979-8-4007-1276-0.
↑Novikov, Oleksii; Fucci, Davide; Adamov, Oleksandr; Mendez, Daniel (2025-09-01). "Policy-driven Software Bill of Materials on GitHub: An Empirical Study". arXiv:2509.01255 [cs.SE].