Also known as: Software Bill of Materials
An SBOM (Software Bill of Materials) is a formal, machine-readable inventory of every component and dependency contained in a piece of software, including version numbers and licence information.
The value of an SBOM becomes obvious the moment a critical vulnerability lands in a widely-used library: the question 'are we affected?' becomes a database query rather than a week of archaeology across every deployed service.
SPDX and CycloneDX are the two dominant formats. Generating an SBOM is now largely automated by build tooling; the hard part is the operational discipline of storing them, keeping them current with what is actually deployed, and querying them under time pressure during an incident.
Software Supply Chain Security
Software supply chain security is the practice of verifying the integrity and provenance of every component, tool, and process that contributes to a piece of software, from source dependencies through the build system to distribution.
CPE
CPE (Common Platform Enumeration) is a structured naming scheme for identifying software, hardware, and operating systems in a machine-readable way, used to state precisely which products and versions a vulnerability affects.
Supply Chain Attack
A supply chain attack compromises an organisation indirectly by targeting a trusted supplier, dependency, or software update mechanism, so that malicious code arrives through a channel the victim already trusts.
SLSA
SLSA (Supply-chain Levels for Software Artifacts) is a security framework that defines graduated levels of build integrity, describing increasingly rigorous requirements for how software artifacts are produced and verified.
Vulnerability Management
Vulnerability management is the ongoing process of identifying, prioritising, remediating, and verifying fixes for security weaknesses across an organisation's systems and software.