[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4m0MrEK-d6167t6qUiSU_G2_8HET1z3VKfBVw9zh9Ic":3},{"article":4,"iocs":47,"watch_terms":48,"solutions":49,"lesson":136},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":24,"category":25,"article_tags":29},"e407f5ec-be2e-42e4-afd0-c0054695ea74","Software Transparency Is Changing: Allan Friedman on SBOM, AI BOMs and What Comes Next","software-transparency-is-changing-allan-friedman-on-sbom-ai-boms-and-what-comes-82b26d","SBOM pioneer Allan Friedman joined the SecurityWeek Podcast to discuss why knowing what is inside software is only the beginning, how AI is complicating software supply chain visibility, and what organizations should be doing with SBOM data once they have it. The post Software Transparency Is Changing: Allan Friedman on SBOM, AI BOMs and What Comes Next appeared first on SecurityWeek.","Cybersecurity policy expert Allan Friedman discussed the importance of Software Bills of Materials (SBOMs) and their evolution, emphasizing that knowing software components is crucial for operational security, not just compliance. He highlighted how SBOM data can accelerate response to widespread vulnerabilities and the emerging concept of AI BOMs, which address the growing complexity of AI models and external data sources in software. Friedman also touched upon the role of Vulnerability Exploitability eXchange (VEX) in contextualizing vulnerability alerts derived from SBOMs.","Allan Friedman discusses SBOM, AI BOMs, and the evolution of software transparency.","https:\u002F\u002Fwww.securityweek.com\u002Fsoftware-transparency-is-changing-allan-friedman-on-sbom-ai-boms-and-what-comes-next\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FAllan-Friedman_SBOM-Podcast.jpg","2026-11-10T16:45:00+00:00","2026-11-10T17:00:04.83317+00:00",7,[17,20,22],{"name":18,"type":19},"AI BOMs","technology",{"name":21,"type":19},"SBOM",{"name":23,"type":19},"VEX","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":24,"icon":26,"name":27,"slug":28},null,"Supply Chain","supply-chain",[30,35,37,42],{"category":31},{"id":32,"icon":26,"name":33,"slug":34},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":36},{"id":24,"icon":26,"name":27,"slug":28},{"category":38},{"id":39,"icon":26,"name":40,"slug":41},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":43},{"id":44,"icon":26,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[],{"controls":50,"vendors":135},[51,80,108],{"slug":52,"name":53,"problem":54,"products":55},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":81,"name":82,"problem":83,"products":84},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[85,93,100],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":95,"url":98,"description":99},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"slug":109,"name":110,"problem":111,"products":112},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[113,121,129],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":130,"product_name":131,"url":133,"description":134},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",[],{"slug":137,"title":138,"body":139,"framework_refs":140,"framework_notes":146},"sboms-are-essential-for-faster-vulnerability-response-and-software-transparency","SBOMs Are Essential for Faster Vulnerability Response and Software Transparency","Organizations that lack a Software Bill of Materials (SBOM) are flying blind when widespread vulnerabilities like Log4Shell emerge, unable to quickly determine which of their systems are affected. Knowing every component in your software supply chain is not merely a compliance exercise — it is an operational necessity that directly shortens response time during active exploitation events. The emergence of AI BOMs further highlights that transparency must extend beyond traditional code to include AI models, training data, and external data sources, all of which introduce risk. Without structured component inventories paired with contextual tools like VEX, security teams waste critical hours triaging irrelevant alerts instead of remediating real exposure.",[141,142,143,144,145],"CIS Control 2: Inventory and Control of Software Assets (v8)","NIST SP 800-53 SA-12: Supply Chain Protection","NIST CSF 2.0 ID.AM-05: Assets are prioritized based on classification, criticality, resources, and impact","NIS2 Article 21(2)(d)","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(d)":147,"NIS2 Article 21(2)(e)":148,"NIST SP 800-53 SA-12: Supply Chain Protection":149,"CIS Control 2: Inventory and Control of Software Assets (v8)":150,"NIST CSF 2.0 ID.AM-05: Assets are prioritized based on classification, criticality, resources, and impact":151},"NIS2's supply chain security point explicitly requires organizations to address security risks in relationships with suppliers and service providers, which SBOM transparency directly supports.","This point covers vulnerability handling and disclosure in acquisition, development, and maintenance — SBOM and VEX together provide the component-level visibility needed to fulfil this obligation effectively.","SA-12 calls for managing risks introduced by components and suppliers across the supply chain, directly aligning with the SBOM mandate to document and track third-party software components.","CIS Control 2 requires maintaining an accurate inventory of all software, which is exactly what an SBOM provides — enabling organizations to identify affected components when a vulnerability is disclosed.","Knowing which software components are present (via SBOM) is a prerequisite for classifying and prioritising assets for vulnerability response, as described in this CSF category."]