SBOM (Software Bill of Materials)
An SBOM (Software Bill of Materials) is a formal, machine-readable inventory of every component, library, and dependency in a piece of software, typically in a standard format like SPDX or CycloneDX, enabling teams to track what they ship and respond quickly to new vulnerabilities.
An SBOM is a complete list of the ingredients in a software product: every direct and transitive dependency, its version, supplier, and often license and cryptographic hash. It is usually generated in a standardized, machine-readable format such as SPDX or CycloneDX so it can be shared and processed automatically.
SBOMs are produced by build tools or composition analysis that resolve the full dependency graph. Once you have one, you can answer critical questions instantly: when a new CVE is disclosed for a popular library, an SBOM lets you determine in seconds whether, and where, your software includes the affected version, rather than manually auditing each project.
For developers and organizations, SBOMs underpin supply-chain security and compliance, and are increasingly expected by customers and regulators. They pair naturally with software composition analysis, which consumes or produces the inventory and maps it against vulnerability data.