20 May 2026 6 min read SBOM
A software bill of materials is the backbone of vulnerability handling — how to produce one and keep it useful.
What an SBOM is
An SBOM is a machine-readable inventory of the components in your software, including dependencies and their versions. It underpins vulnerability tracking and CRA evidence.
How to produce it
- Generate from your build pipeline in a standard format (e.g. SPDX or CycloneDX).
- Capture transitive dependencies, not just direct ones.
- Regenerate on every release so it stays accurate.
Make it actionable
An SBOM only helps if you map it to known-vulnerability feeds and can answer 'are we affected?' quickly.
This is an educational explainer. For the canonical regulation reference, see the dedicated SBOM page — or run an assessment to see how it applies to your product.