SBOM Software Bill of Materials
Software Bill of Materials — a complete "inventory" of all the components and dependencies in a piece of software. When a new vulnerability is discovered in a library, you can quickly look up in your SBOMs which products are affected. Log4Shell made them a priority.
Problem: modern software is built from hundreds of third-party dependencies (often dependencies of dependencies, deeply nested) — no one has them in their head. When Log4Shell hit (2021) organizations spent weeks just figuring out IF and WHERE they even used the vulnerable Log4j. An SBOM solves it: a machine-readable list (in standard formats like CycloneDX or SPDX) of exactly which components and versions are included. Win: fast impact analysis on new vulnerabilities ("which of our systems run the affected library?"), supply-chain transparency, and license/compliance tracking. Generated automatically in the build pipeline. Pushed by regulation (e.g. the US Executive Order on software security requires SBOMs for vendors). A cornerstone of supply-chain security. Related to SLSA and supply-chain attack.