The ultimate guide to SBOMs | GitLab

Learn what a software bill of materials is and why it has become an integral part of modern software development.

In March 2026, four supply chain attacks unfolded in 12 days, compromising tools trusted by millions of development teams, including a vulnerability scanner, an infrastructure security scanner, an AI model gateway, and one of the most widely used HTTP clients in the JavaScript ecosystem. In each case, the attack surface was the same: the dependencies flowing through CI/CD pipelines. Most of those organizations were running security tools. What they couldn't see was what was inside the packages those tools depended on. That visibility starts with a software bill of materials, or SBOM. What…

related reading

• Defining A Software Supply Chain Security Platform & Exploring New Techniques, Part 2softwareanalyst.substack.com
• Software Supply Chain Security (Part 1)softwareanalyst.substack.com
• Project Glasswing: Securing critical software for the AI era \ Anthropicanthropic.com
• OWASP Foundation - The Open Source Foundation for Application Securityowasp.org
• State of DevSecOps | Datadogdatadoghq.com
• OpenSSF Scorecardsecurityscorecards.dev
• Security incident disclosure — July 2026huggingface.co
• Getting Secure Beyond CVE Scanningpulse.latio.tech
• Fixing Rust's supply chain security: The good, the bad and the uglykerkour.com
• The Rise Of Application Security Posture Management (ASPM) Platformssoftwareanalyst.substack.com
• Vulnerability Management and XZ Utils - Is there any hope?pulse.latio.tech
• Akritesakrites.org