Why SBOMs?

If you've never worked with SBOMs before, start here. This page is background — no TraceGuard specifics — so the rest of the docs make sense.

Your software is mostly other people's software

A modern application is assembled from hundreds or thousands of open-source packages, each pulling in its own dependencies. You wrote a fraction of the code you ship; the rest is your software supply chain. When a vulnerability or malicious change lands in any of those parts, it's your problem to find and fix.

Recent incidents made this concrete:

• Log4Shell (2021) — a critical flaw in the ubiquitous log4j library. The scramble wasn't fixing it; it was answering "where do we even use it?"
• xz-utils backdoor (2024) — a malicious maintainer nearly slipped a backdoor into a core Linux compression library used everywhere.
• SolarWinds (2020) — attackers compromised a build pipeline to ship tainted updates to thousands of organizations.

In each case, the organizations that could answer "what's in our software?" quickly responded in hours; the rest spent weeks.

What an SBOM is

A Software Bill of Materials (SBOM) is a machine-readable inventory of the components in a piece of software — like an ingredients label. For each component it records what it is, its version, and how it relates to the others.

Two open formats dominate, and TraceGuard reads both:

• CycloneDX — security-focused, from OWASP.
• SPDX — broad and ISO-standardized, common for license compliance.

What an SBOM lets you do

• Answer "where do we use X?" instantly — the difference between a same-day response and a multi-week fire drill.
• Prioritize real risk — combine an SBOM with vulnerability data (and signals like KEV and EPSS) to focus on what's actually exploitable.
• Communicate status — say "we ship this component, but we're not affected" with a justification, using VEX.
• Satisfy regulators and customers — many regimes now expect SBOMs and evidence. See Compliance & regulations.

Where TraceGuard fits

Producing an SBOM is the easy part — tools like Syft or your build system do it. The hard part is doing it continuously across every project, turning it into prioritized findings, recording your decisions, and keeping audit-ready evidence. That's what TraceGuard is for. Continue with Core concepts or jump into the Quickstart.