An older report is still useful for learning how the category was framed, but check it against current standards before relying on it. SBOM formats, government guidance and exploit data sources have all moved recently, so a feature list written a year ago may not match what buyers need now.
What has changed in public standards
Several fixed points have shifted, and we confirmed each from the publisher.
- CycloneDX is at version 1.7, released 2025-10-21, and was published as ECMA-424 on 2025-12-10.
- SPDX is recognised under ISO/IEC 5962, available since August 2021.
- CISA's SBOM page highlights 2026 joint guidance adding new SBOM data fields, practices and processes, with a separate resource on 2026 minimum elements.
- CISA describes a VEX document as an attestation, a form of security advisory, indicating whether products are affected by known vulnerabilities.
- SLSA's version 1.0 page is marked retired and points to version 1.2 as current.
A report scoped before these changes may describe SBOM support in older terms, or not mention VEX at all.
A freshness test
Run four checks on any report older than a few months.
- Date. When was the research done, which can be earlier than the publication date?
- Product versions. Which versions were evaluated? Vendors ship often.
- Standards named. Does it reference the current versions of the formats and frameworks you require?
- New capabilities. Does it cover things you care about that appeared later?
What ages slowly, and what ages fast
Some parts of a report keep their value. Market definitions, buyer questions and vendor viability trends change gradually. Capability scores and feature comparisons age faster, because products change monthly.
So use an older report for orientation and not for scoring.
How to compensate
- Ask every vendor for current release notes covering the last two quarters.
- Test the standards you need directly. Request an SBOM export in your required format and validate it with a tool you trust.
- Ask for a VEX example if you plan to use one.
- Read the vendor's public documentation, not only their sales deck.
A note on your own documents
The same applies in reverse. If your RFP template still lists last year's requirements, update it. Buyers carry old assumptions into new purchases more often than vendors carry old claims.
Safeguard offers SBOM and dependency scanning with a free scan at gold.safeguard.sh/scan, a quick way to inspect current output on your own project.
If you must choose between an older report and a newer one that covers a different scope, pick the one whose scope matches your purchase, then use the other for background.
Quick check
How old is too old?
There is no fixed cutoff. If the standards or product versions it names have since changed, treat it as background only.
Does a newer report always beat an older one?
Not automatically. Compare scope, criteria and fit to your needs, not only the date.
Sources
Last reviewed: 19 October 2026.
