What is an SBOM (software bill of materials)?
Glossary
The short answer |
|---|
A software bill of materials (SBOM) is a formal, machine-readable inventory of the components that make up a piece of software, including open source and third-party libraries, their versions, suppliers and dependency relationships. CISA describes it as a nested list of ingredients. Teams use SBOMs to track supply chain risk and quickly find software affected by a new vulnerability. |
How does an SBOM work?
Tools read your package manifests, lockfiles, container images or compiled binaries and record what they find in a standard format. The two common formats are SPDX and CycloneDX. Each entry describes one component and how it relates to the others, so you can trace a vulnerable library through every service that pulls it in.
The 2021 NTIA minimum elements set a baseline of seven data fields, and CISA has since published updated minimum elements guidance in 2026:
Supplier name
Component name
Component version
Other unique identifiers, such as a package URL
Dependency relationship
Author of the SBOM data
Timestamp
Why does an SBOM matter for startups?
Most modern applications are built largely from open source packages. When a widely used library has a critical flaw, the first question from customers is whether you are affected. With current SBOMs you can answer that with evidence instead of a manual hunt through repositories. Enterprise security reviews increasingly ask for SBOMs, so generating them early saves a scramble later.
AIBOM, CBOM and HBOM
The same idea now extends beyond application code. The OWASP CycloneDX standard supports several related inventories:
Inventory | What it lists | Why it is useful |
|---|---|---|
AIBOM (CycloneDX calls it ML-BOM) | AI models, datasets and their sources | Shows what models you depend on and where they came from |
CBOM | Cryptographic algorithms, keys, certificates and protocols | Finds weak or soon-to-be-deprecated cryptography |
HBOM | Hardware components | Tracks risk in devices and embedded systems |
How NexusVoid handles it
Argus, NexusVoid’s application security product, generates SBOM, AIBOM, CBOM and HBOM inventories alongside its SAST, SCA and secrets scanning. Dependency findings are tied to the inventory, mapped to MITRE ATT&CK with attack paths, and come with a fix as a pull request. Argus retests on merge and files the result as evidence against your compliance controls.
Related terms
ASPM (application security posture management)
Vulnerability scanning
Continuous compliance
Security questionnaire
Compliance automation
Frequently asked questions
Is an SBOM legally required?
For most private companies, no single law requires one. US federal agencies began asking software suppliers for SBOMs after Executive Order 14028 in 2021, and some regulated sectors and large enterprise buyers now include SBOM requests in contracts. In practice, the pressure usually arrives through a customer security review rather than a regulator. Check the specific contract or regulation that applies to you.
Should I use SPDX or CycloneDX?
Both are open, machine-readable standards and most tools can export either. SPDX, from the Linux Foundation, is also published as ISO/IEC 5962 and has deep roots in license compliance. CycloneDX, from OWASP, was designed with security use cases in mind and covers related inventories such as ML, cryptography and hardware. Pick the one your customers ask for, or the one your tooling produces most reliably.
How often should an SBOM be generated?
Generate a new SBOM every time you build a release, ideally automatically in your CI pipeline. A static SBOM made once a year goes stale quickly because dependencies change with every update. Keeping SBOMs tied to builds means that when a new vulnerability is announced, you can check exactly which deployed versions contain the affected component.
Does an SBOM tell me if I am vulnerable?
Not by itself. An SBOM is an inventory, not a vulnerability report. You match it against vulnerability databases to find known issues, then decide whether the vulnerable code is actually reachable in your application. Some teams pair SBOMs with VEX statements, which record whether a known vulnerability affects a given product, to cut down on false alarms.
If a customer has asked for your SBOM and you are not sure where to start, book a call at /contact and we will show you what yours would look like.
Something wrong in this post? Tell us at lakshay@nexusvoidai.com and we will fix it and say so.
More terms
ASPM
ASPM pulls the findings from all your application security tools into one prioritized view, so a small team fixes the risks that matter first.
Attack surface management
Attack surface management continuously finds everything you expose to the internet, including what you forgot about, and flags what an attacker could use.
Autonomous CISO
An autonomous CISO is software that runs the day-to-day work of a security program, so startups get continuous security, with compliance following from it.
Start with a real security program.
Tell us what you need to fix first and we will show that part live, on a stack like yours.