The Missing Link - How we collect and leverage SBOMs
summary
Company policy changes and a lightweight platform generate and store 4,000+ SBOMs mostly from binaries, indexed for dependency lookup and customer sharing (downloadable as CycloneDX and SPDX). Those SBOMs feed a dashboard and binary-analysis scans to triage Log4j and OpenSSL, cutting repeated code-walks across ~500 concurrent projects. Operational metrics: about 30–40 major impact assessments a year that previously average over 30 days now return actionable hits much faster, saving substantial developer hours.
AI-written summary · about
chapters (10)
- 0:00Supply chain security & SBOMs
- 5:45Schneider Electric adopts SBOMs
- 13:13SBOMs for complex systems
- 16:46Vulnerability management with SBOMs
- 23:56SBOM generation challenges
- 31:06Customer access & SBOM formats
- 36:49Saving dev hours with SBOMs
- 41:43Managing thousands of SBOMs
- 43:29Calculating SBOM savings
- 45:16Q&A on SBOMs
related talks
57mSBOMs – The Missing Link
43mUsing SBOMs for Linux Foundation Projects
29mUnlocking the Power of SBOMs: A Deep Dive into Risk Management and Cybersecurity Posture
22mBuilding a Robust SBOM Solution with Backstage.io
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
35mTransforming SBOMs from Compliance Burden to Security Asset
26mSBOM today: What is the state of SBOMs?
27mSBOM: The Rest Of the Story