SBOMs in the Real World: Practical Guidance for Managing Three Common SBOM Scenarios
summary
Three practical workflows: generate SBOM at build time (per build/commit, combine into application-level SBOMs and pin releases), internal aggregation for enterprise remediation (import into tools like dependency-track, prioritize fixes using EPSS and grouping to get biggest reduction for least refactor), and supplier ingestion (require CycloneDX or SPDX with use CycloneDX and purl, validate relationships, VEX/VDR assertions, and two-way remediation). Claims: most orgs (80%+) only reach scenario one, ~90% do not import SBOMs effectively; CPE is unreliable, purl is preferred.
AI-written summary · about
chapters (10)
- 0:00Introduction to SBOMs
- 3:11SBOM landscape and drivers
- 8:45Generating and distributing SBOMs
- 17:32Centralizing vulnerability management
- 23:59Vulnerability assessment workflow
- 29:56Enforcing SBOM standards
- 38:58Validating supplier SBOMs
- 47:29Real-world challenges
- 51:00Generating SBOMs at build time
- 57:02Q&A
related talks
20mSBOMs in the Real World: Practical Guidance for Managing Three Common SBOM Sce...
27mSBOM: The Rest Of the Story
36mSBOMs, VEX, and Kubernetes
46mSBOMs Are Not Enough
26mSBOM today: What is the state of SBOMs?
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
34mSBOMs: zero to hero in 25 mins!
45mSmarter Than Your Average SBOM!