SBOM
Software Bill of Materials
A list of the components and libraries that make up a piece of software.
In Simple Terms
An SBOM is a list that shows exactly which programs and libraries were combined to build a piece of software. Think of it like the ingredient list on a food package — it tells you exactly what's inside. When a security flaw turns up in some program, an SBOM lets you quickly check whether that program is part of a given piece of software. It's a management approach used to keep an entire system secure.
Behind the Name
"SBOM" stands for "Software Bill of Materials." The term borrows from "Bill of Materials," a list of parts and materials used in manufacturing — so an SBOM is essentially the software equivalent of that inventory list.
Take a Closer Look!
An SBOM is a list that catalogs the component information — the programs and external libraries — that make up a piece of software.
Modern software development relies heavily on open source software (OSS) and external libraries, so an SBOM is created to accurately record and track exactly which versions of which components are being used across a system.
Specifically, it records not just the code a company writes in-house, but also the names, license information, and version numbers of every external library the software depends on.
If a new vulnerability is discovered in a particular library, checking it against an existing SBOM lets you quickly identify which parts of the system are affected — without having to manually comb through the source code.
In large-scale system development involving multiple companies or teams, and in security audits, SBOMs are also used as a key document for visualizing a software's makeup and boosting transparency and security across the entire supply chain.