Customers load the SBOM into a tool, match its components against vulnerability and license data, and compare it with the last one. Some file it for audit. Knowing these uses helps you prepare the file and the follow up answers before the questions arrive.
Four common uses
| Use | What the customer does | What you should prepare |
|---|---|---|
| Vulnerability matching | Match components to advisories | Status answers per finding |
| License review | Check licenses against policy | License data, and unknowns marked |
| Inventory | Record what runs in their environment | Correct version and identifiers |
| Audit evidence | File it with a review | A dated cover note |
Vulnerability matching
CISA's 2026 text says that after learning new vulnerability information, an organization can assess whether its SBOMs contain or reference a vulnerable component, significantly improving response time compared to organizations without SBOMs. It adds that advisories such as VEX and CSAF can narrow the scope of at risk components.
For you, this means a customer may message you the day a new advisory appears, asking if your product is affected. Have a standard reply ready. See how to answer were we affected.
License review
The 2026 elements include a component license field, using identifiers that let the recipient find full license details. Customers with open source policies will check it. If license data is unknown for some components, they will ask. Say so in advance.
Inventory and approved lists
The CISA text says organizations can map SBOM data to other sources, such as security advisories or organization level approved or not approved software databases. A customer may flag a component their policy forbids. You may not be able to change it quickly. Prepare a response that says what the component does in your product and your plan, if any.
Integrity checks
With a signature and component hashes, a recipient can confirm the file came from the author unchanged and check that components match. The 2026 elements list both. If you do not provide them, say so in the cover note.
Monitoring over time
Some customers keep the SBOM and rescan it as new advisories appear, which means their findings change even though your file does not. That is expected. Tell them how to reach you with questions, and what you will do when a finding is relevant.
What to do before sending
- Run the same kind of match yourself on the file.
- Prepare status answers for anything surprising.
- Mark unknown fields explicitly.
- Write the cover note.
- Tell the customer who to contact.
Try it yourself
Open the demo to see how an inventory is tracked over time. Look for how findings can change while the product does not, which is what a customer's tool will do with your file.
Click through it at your own pace, or open it full screen.
Quick check
Why do customers find findings that we did not?
They may use different databases or run on a different day. Compare against the same data before replying.
Do customers need our permission to scan the SBOM?
That depends on the terms you set. The NTIA report says that if access control is desired, terms must be specified, including allowances for integrating the data into security tools.
Safeguard's SBOM and dependency scanning and reachability analysis can show you the findings a customer is likely to see before you send the file, and the free scan is a quick way to try it.
Sources
- 2026 Minimum Elements for a Software Bill of Materials (SBOM), CISA and partners, 29 July 2026
- The Minimum Elements For a Software Bill of Materials (NTIA, 2021)
Last reviewed: 19 October 2026.
