The ultimate guide to SBOMs | GitLab

Learn what a software bill of materials is and why it has become an integral part of modern software development.

In March 2026, four supply chain attacks unfolded in 12 days, compromising tools trusted by millions of development teams, including a vulnerability scanner, an infrastructure security scanner, an AI model gateway, and one of the most widely used HTTP clients in the JavaScript ecosystem. In each case, the attack surface was the same: the dependencies flowing through CI/CD pipelines. Most of those organizations were running security tools. What they couldn't see was what was inside the packages those tools depended on. That visibility starts with a software bill of materials, or SBOM. What…

related reading

• Defining A Software Supply Chain Security Platform & Exploring New Techniques, Part 2softwareanalyst.substack.com
• Software Supply Chain Security (Part 1)softwareanalyst.substack.com
• Sandwich Bill of Materials | Andrew Nesbittnesbitt.io
• A Deep Dive Into The Cloud & Application Security Ecosystemsoftwareanalyst.substack.com
• OpenSSF Scorecardsecurityscorecards.dev
• We should all be using dependency cooldownsblog.yossarian.net
• OWASP Foundation - The Open Source Foundation for Application Securityowasp.org
• Fixing Rust's supply chain security: The good, the bad and the uglykerkour.com
• Akritesakrites.org
• Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies | by Alex Birsan | Mediummedium.com
• What is Scrum? Guide to the Agile Frameworkatlassian.com
• What Full-Stack Observability Requires Todaynewrelic.com