Glossary
SBOM (Software Bill of Materials)
A formal, machine-readable inventory of the components and dependencies that make up a piece of software.
A Software Bill of Materials (SBOM) lists the components inside a piece of software — libraries, packages and their versions, often with identifiers such as package URLs (PURLs) and relationships between components. The two dominant formats are SPDX and CycloneDX, and SBOMs can be generated at build time from source and lockfiles or afterwards from container images and binaries.
SBOMs turn "are we affected by this new CVE?" from a scanning exercise into a query. When they are generated for every build and stored centrally, a VOC can identify affected products and images within minutes of a disclosure.
An SBOM describes what is present, not what is exploitable; pair it with VEX statements to separate real exposure from noise. See vulnerability scanning strategy and the tooling landscape.