IT Glossary
A Software Bill of Materials (SBOM) is an inventory of all components in software. Learn what an SBOM contains, why it matters for supply-chain security.
July 3, 2026
A Software Bill of Materials (SBOM) is a formal, machine-readable inventory of all the components, libraries, and dependencies that make up a piece of software. Like an ingredients list, it lets organizations understand exactly what is inside their software, identify vulnerable components quickly, and manage software supply-chain security and compliance.
An SBOM records several elements per component: the component name (for example an open-source library), the exact version in use, the supplier that produced it, and the dependency relationship, whether direct or transitive.
When a critical vulnerability hits a popular library, companies with SBOMs identify every affected application within hours, while others scramble for days. SBOMs target the software supply chain at the code level. The organizational analog is full visibility over the SaaS supply chain: knowing every vendor and app that touches your data. Both rest on the same principle, you cannot secure what you have not inventoried.
To provide a complete inventory of software components so organizations can find vulnerable parts quickly and manage supply-chain risk and compliance.
Common machine-readable standards include SPDX and CycloneDX, which let tools generate, share, and query SBOMs automatically.
An SBOM inventories code components, while SaaS discovery inventories the apps and vendors in your stack. Both apply the principle that you cannot secure what you have not inventoried.
