Trust but Verify: Uncovering the Hidden Risks of Inaccurate SBOMs With J...
summary
JBomAudit is an open-source verifier that scans jar bytecode and compares declared dependency trees to actually referenced classes using a binary analyzer. Analysis of 25,000 Java SBOMs finds nearly 8,000 missing direct dependencies and roughly 20,000 incorrect direct dependencies, with common omissions like Guava exposing known CVEs. Generators that rely on a single pom metadata cause most errors; the tool outputs detailed non-compliance reports and supports layer and global comparison modes.
AI-written summary · about
chapters (9)
- 0:00Trust but verify principle
- 1:05Semantic gap in metadata
- 4:45SBOM dependencies and risks
- 11:26JVM Audit tool overview
- 14:37JVM Audit detection design
- 21:26Inaccurate SBOMs root causes
- 26:27JVM Audit demo and scans
- 31:10Key takeaways and availability
- 32:01Q&A on SBOM generation
related talks
17mTrusted-SBOM: On the Critical Importance of Verifying SBOMs
41mYour SBOM Is Lying To You – Let’s Make It Honest
29mUnlocking the Power of SBOMs: A Deep Dive into Risk Management and Cybersecurity Posture
34mSBOM Quality: We Need More Than a Simple “SBOM Button” for Compliance
32mAsleep at the Wheel: Getting your SBOMs to pay attention...
27mSecuring Open Source With SBOM: From Visibility To Trust
46mSBOMs Are Not Enough
52mFrom Kitchen to Table: A Safe Software Journey with SBOMs