What Is an SBOM and Do You Actually Need One?
A software bill of materials in plain terms: what it lists, who is starting to demand it - NIS2, CRA, big customers - and the free way to make one.
Short answer
An SBOM is a list of components in your software - packages, versions, licenses. Generate from lockfiles and store it with each release. It speeds CVE response dramatically.
Do you need one now
If enterprise buyers or regulated customers ask - yes. If not, still generate one for yourself.
Incident hour is the wrong time to invent inventory from memory.
Readers skimming what is an sbom often stop at definitions. The part that prevents incidents is the verification step after the change - and the habit of re-checking after the next deploy that touches the same layer.
How to make one free
Export from your package manager or CI. Keep it next to the release artifact.
Automate it so every release has an SBOM without a hero checklist.
Common failure mode for what is an sbom: staging looks fine, production still serves the old config because a CDN, load balancer, or second vhost was never updated. Always verify the hostname customers hit.
How you use it
When a CVE hits a popular library, search the SBOM instead of guessing.
That is the whole product value of the document - searchable truth about what you shipped.
If this section on what is an sbom becomes a recurring ticket, automate the check. Manual one-offs rot; a post-deploy assertion or weekly grade keeps the control honest.
What to do this week
- Generate an SBOM from the current lockfile/CI.
- Store it with the latest release artifact.
- Automate SBOM generation on the next release.
- Practice: search the SBOM for one noisy CVE library name.
Parts list first. Panic second.
Update log (1)
2026-06-27Editorial form rewrite for length and uniqueness.
Sources + verification
Practical guidance based on mainstream browser behavior, common reverse-proxy configuration, and widely published RFCs and vendor docs. Verify on your own stack with curl, browser devtools, and a re-scan after each change.
