NewsPublished 10 Nov 2026

Software Transparency Is Changing: Allan Friedman on SBOM, AI BOMs and What Comes Next

Source SecurityWeek

supply-chain

Description

This content discusses the evolving role of Software Bill of Materials (SBOM) in software supply chain security, highlighting the challenges introduced by AI components and the need for actionable use of SBOM data. It emphasizes that SBOMs are foundational for understanding software composition but must be integrated into operational security processes to effectively manage vulnerabilities. The emergence of AI BOMs adds complexity due to dynamic models and data sources. The discussion also covers the importance of Vulnerability Exploitability eXchange (VEX) to prioritize risks and addresses concerns about SBOM disclosure from a defender's perspective.

Impact

The impact is primarily operational and strategic in nature, improving organizations' ability to quickly identify and respond to software supply chain vulnerabilities. Enhanced transparency through SBOMs and VEX enables faster risk assessment and prioritization, potentially reducing exposure to widespread vulnerabilities like Log4j. The complexity introduced by AI components in software increases the challenge of maintaining accurate inventories and understanding risk, which could affect the effectiveness of vulnerability management if not addressed. There is no direct exploitation or vulnerability described, but the content underscores the importance of these tools in mitigating supply chain risks.

Defensive guidance

This is not a vulnerability with a patch but a discussion on improving software supply chain security practices. Organizations should focus on obtaining accurate SBOMs from suppliers and integrating SBOM data into vulnerability management, asset management, and risk processes. They should also adopt VEX to better prioritize vulnerabilities based on exploitability context. Preparing for AI BOMs by developing transparency and logging mechanisms around AI models and data sources is recommended. No immediate action or patch is required; rather, this is guidance for enhancing operational security maturity.

Summary

The discussion centers on the importance of SBOMs as structured inventories of software components and dependencies, which are critical for rapid vulnerability response and supply chain risk management. Allan Friedman explains that SBOMs alone are insufficient unless integrated into enterprise security workflows such as vulnerability and asset management. The introduction of AI BOMs reflects the increasing complexity of software incorporating AI models and external data, necessitating new transparency approaches. VEX is highlighted as a tool to contextualize vulnerabilities, reducing alert fatigue by distinguishing exploitable conditions from mere component presence. The conversation also counters intellectual property concerns by noting that defenders require visibility into software components to effectively protect environments.

References

securityweek.com/software-transparency-is-changing-allan-friedman-on-sbom-ai-boms-and-what-comes-next/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 10 Nov 2026, 16:48 UTC

References

Community reviews

Related threats