Device firmware is assembled from many parts: an RTOS, a TLS library, a network stack, drivers, a JSON parser, vendor SDKs. When a CVE is published for one of them, the first question is which products contain the affected version, and without an SBOM that answer takes days of archaeology. Formats such as SPDX and CycloneDX make the inventory machine-readable so it can be matched against vulnerability databases automatically.
Regulators now expect one. The EU’s Cyber Resilience Act and U.S. federal procurement rules both reference SBOMs as part of demonstrating that a manufacturer can handle vulnerabilities over a product’s support period. Generating it from the build system, rather than by hand, is the only way it stays accurate across releases.
Part of the IoT Glossary. Spotted an error or a missing term? Tell us.