SBOMs in 2026: Some Love, Some Hate, Much Ambivalence

SBOMs in 2026 are seen as valuable in theory but a practical mess, with experts divided on their usefulness as the software landscape evolves. Docker has embraced SBOMs in its DHI images, which are built to include complete SBOMs and proof of provenance using SLSA Level 3, while acknowledging that many organisations still generate incomplete SBOMs or rely on manual processes.

According to the US Cybersecurity and Infrastructure Security Agency (CISA), recent guidance requires machine-readable formats such as SPDX or CycloneDX to aid automation, but practitioners remain doubtful about how operational SBOMs truly are in real-world pipelines. Industry voices emphasise that SBOMs alone do not reduce risk; the focus should be on accurate, context-rich and timely SBOMs that reflect what is actually shipped, especially in embedded and compiled software.

Noting broader trends, the article also highlights SLSA as a complementary framework for securing build pipelines and mentions the rise of AI BOMs as organisations increasingly consider components, datasets and models in governance and security. Published on 29 December 2025, the piece suggests that while SBOMs won’t be a silver bullet, they will be part of a broader shift toward more transparent software supply-chain practices.