Software Transparency Is Changing: Allan Friedman on SBOM, AI BOMs and What Comes Next
Allan Friedman discusses SBOM, AI BOMs, and the evolution of software transparency.
Cybersecurity policy expert Allan Friedman discussed the importance of Software Bills of Materials (SBOMs) and their evolution, emphasizing that knowing software components is crucial for operational security, not just compliance. He highlighted how SBOM data can accelerate response to widespread vulnerabilities and the emerging concept of AI BOMs, which address the growing complexity of AI models and external data sources in software. Friedman also touched upon the role of Vulnerability Exploitability eXchange (VEX) in contextualizing vulnerability alerts derived from SBOMs.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonOrganizations that lack a Software Bill of Materials (SBOM) are flying blind when widespread vulnerabilities like Log4Shell emerge, unable to quickly determine which of their systems are affected. Knowing every component in your software supply chain is not merely a compliance exercise — it is an operational necessity that directly shortens response time during active exploitation events. The emergence of AI BOMs further highlights that transparency must extend beyond traditional code to include AI models, training data, and external data sources, all of which introduce risk. Without structured component inventories paired with contextual tools like VEX, security teams waste critical hours triaging irrelevant alerts instead of remediating real exposure.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.