An SBOM, or software bill of materials, is a formal record of the components used to build a piece of software and how they relate to each other. NIST defines it that way, and CISA describes it as a nested inventory, a list of ingredients that make up software components.
What an SBOM actually contains
Think of the label on a food package. The label does not tell you whether the food is safe. It tells you what went in, so you can check that list against whatever you care about, such as an allergy.
An SBOM works the same way for software. For each component it records identifying details such as the name and version, and it records the relationships between components, for example which library pulled in which other library. The list is nested because components depend on components.
Who uses one and why
CISA calls the SBOM a key building block in software security and software supply chain risk management, and promotes it as a transparency tool across the software ecosystem.
In practice, three groups reach for it:
- Engineers use it to answer "are we running the affected library?" when a new vulnerability is announced.
- Security teams use it to track what is deployed across many products.
- Buyers ask suppliers for one so they can see what they are accepting into their environment.
The common thread is speed. Without an inventory, the first hour of every incident is spent finding out what you run.
What an SBOM does not tell you
An SBOM is a list, not a verdict. It does not say whether a listed component is vulnerable, whether the vulnerable code is reachable, or whether the build was tampered with. Those questions need other data, such as vulnerability feeds, reachability analysis and signed build evidence.
An SBOM is also only as good as how it was produced. One generated at build time from the real dependency graph tells you more than one assembled by hand once a year.
Formats you will meet
Two formats dominate: SPDX and CycloneDX. Both can carry the same core idea, and most tools read both.
Click through it at your own pace, or open it full screen.
Safeguard generates and ingests SBOMs and runs dependency scanning against them. You can try a free scan at gold.safeguard.sh/scan.
Quick check
Is an SBOM the same as a vulnerability report?
No. An SBOM lists components. A vulnerability report says which known flaws affect them. You combine the two.
Does an SBOM include transitive dependencies?
A good one does, because the nested relationships are the point. A flat list of only direct dependencies misses most of what you ship.
Sources
Last reviewed: 19 October 2026.
