Concept / Term · Established
Software Bill of Materials
A machine-readable inventory of the software components and dependencies inside a product, used to understand supply-chain and vulnerability exposure.
Field note
A Software Bill of Materials is an inventory of the components included in a software product, often recording names, versions, suppliers and dependency relationships in a machine-readable format.
The term adapts manufacturing’s bill of materials to software supply chains, where products are assembled from large numbers of open-source and commercial components.
Security teams compare an SBOM with vulnerability information to determine quickly whether a newly disclosed issue affects a deployed product.
A team cannot assess or patch a vulnerable dependency promptly if it does not know where that dependency is used.
In a sentence“The supplier’s SBOM confirms that the affected library version is not present in this release.”