SBOM Standards
SPDX 3.0: What Changed and Why It Matters
SPDX 3.0 is a major overhaul of the ISO-standard SBOM format. Here is a practical breakdown of the new profile system, linking model, and what it means for adoption.
Apr 15, 20246 min read
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
SPDX 3.0 is a major overhaul of the ISO-standard SBOM format. Here is a practical breakdown of the new profile system, linking model, and what it means for adoption.
As AI models become critical infrastructure, the need for transparency about their components, training data, and dependencies grows urgent. Emerging standards are beginning to address this gap.
CycloneDX v1.5 introduced formulation, machine learning BOMs, and expanded evidence. Here is what changed and how to take advantage of it.
Weekly insights on software supply chain security, delivered to your inbox.