Allan Friedman Says Software Bills of Materials Need a Purpose

Allan Friedman, a pioneer of SBOM, recently joined the SecurityWeek Podcast to explain that knowing what is inside software is only the starting point. The discussion covers how AI is complicating software supply‑chain visibility and what organisations should do with SBOM data once they have it.

Friedman frames software as assembled from many components, and he argues that an SBOM is a structured inventory rather than a final objective; the real value lies in how organisations and their suppliers use that data for risk management, threat hunting and incident response.

A key point is that improved visibility does not automatically equal improved security. Friedman stresses that after receiving an SBOM, organisations should integrate the data into vulnerability management, asset management and continuous risk assessment, rather than treating the SBOM as a static document.

He highlights the Vulnerability Exploitability eXchange, or VEX, as essential for distinguishing between the mere presence of a vulnerable component and an actual exploitable condition, especially in a world of more alerts and more complex software stacks. The conversation also looks ahead to AI BOMs, which would document models, data, external sources and the harnesses that run AI systems, raising questions about provenance and responsibility.

The dialogue then shifts to practical implementation and interoperability concerns. Friedman calls for continued collaboration among governments, industry bodies and the open‑source community to harmonise SBOM standards and enable meaningful data exchange.

He urges defenders to use SBOM data to drive proactive security, rather than to treat it as a compliance artefact, and he teases a broader “omnibomb” vision that could converge SBOMs with other transparency mechanisms like cryptographic and hardware bills of materials.