On a live call, say what an SBOM is in one sentence, confirm you can provide one for the version they run, name what it does not cover, and promise a written follow up the same day. Do not improvise numbers, formats or dates you have not checked.
The 30 second spoken answer
Try something like this, in your own words:
"Yes, we can send one. An SBOM is a list of the components inside the software, with versions and who made them. We will send it for the exact version you run, in a format your tools can read. It tells you what is in the product. It does not by itself tell you which items are exploitable, so we can also explain how we handle that. I will email you today to confirm the version and the format."
That answer is accurate, short and does not overreach. It matches how CISA's 2026 minimum elements describe the document: a nested inventory, a list of ingredients that make up software.
Three questions to ask before the call ends
- Which product and version do you run?
- Which format do your tools read, SPDX or CycloneDX?
- Who receives it, and does your team scan it on arrival?
Write the answers in the call notes while the customer is still talking. They become the engineering request.
Phrases that help and phrases that hurt
| Say | Avoid |
|---|---|
| "We can provide one for your version." | "Everyone gets the same file." |
| "It lists components, not exploit status." | "It proves we are secure." |
| "If your scan finds items, we will respond with a status for each." | "Your scanner will produce false alarms." |
| "I will confirm a date in writing." | "You will have it this afternoon." |
If you get a hard question
Some questions need an engineer. Do not guess.
- "Does it include every transitive dependency?" The CISA text says there is no minimum depth, and an SBOM should include all components, including transitive ones. Say that is the goal, and that engineering will state any gaps in the cover note.
- "Is it signed?" Say you will confirm. The 2026 elements list a digital signature from the SBOM author as an element, so it is a fair question.
- "Will you send one for every release?" Say you will check what you can commit to. Do not agree on the call.
The same day follow up
Send a short email within the day. Include the product and version you understood, the format, the recipient, and a delivery date. If the date is not known, say when you will know. See what sales should say first for a written template.
Try it yourself
Open the demo to see a dependency inventory the way a customer would. Notice that it lists components and versions without saying which are exploitable. That distinction is the one to explain.
Click through it at your own pace, or open it full screen.
Quick check
Can I say the SBOM proves our product is safe?
No. The CISA text describes an SBOM as data about components. It says analysis of that data turns it into insight about risk.
What if I do not know the answer on the call?
Say so, write the question down, and answer in writing after checking with engineering.
Safeguard's SBOM and dependency scanning helps engineering keep the inventory behind these answers current, and the free scan shows what an inventory looks like for your own code.
Sources
Last reviewed: 19 October 2026.
