Your Source for Software
Supply Chain Insights

This is where you’ll find out about our latest obsessions, tips and tricks, insights on what we’ve been working on and where IoT and software supply chain security is going.

Thought Leadership

Technical Deep Dive

Actionable Guidance

SBOM Minimum Elements: What Changed in CISA 2026

CISA's 2026 Minimum Elements replace the NTIA 2021 baseline and are co-sealed by 18 agencies across 14 countries. We map every change, field by field.

What is an SBOM (Software Bill of Materials)?

An SBOM (Software Bill of Materials) is a comprehensive and detailed list of all the software components

Next-Gen Artificial Intelligence and Autonomous Risks

As AI shifts from generative to autonomous, agentic AI, cognitive AI ecosystems, and AI-powered deepfakes each introduce new supply chain risks. Chuck Brooks breaks down why SBOMs for AI models are becoming essential to spotting compromised components before they cause operational, financial, or reputational damage.

SBOM's Moment of Validation at the UN's AI for Good Summit

At the UN's AI for Good Summit in Geneva, SBOM stopped being a hard sell. Duncan Sparrell found transparency, governance, and provenance woven through the entire program, proof that the case for SBOM has been won. The next challenge: extending that same rigor to AI supply chains under frameworks like the G7 AIBOM Minimum Elements.

From SBOM to QBOM: Why Bills of Materials Are Becoming the Operating System for Cyber Resilience

EO 14412 has put a federal deadline on Cryptographic Bills of Materials (CBOM), arriving alongside AIBOM, HBOM and QBOM. Dr. Georgianna Shea explains what each BOM type does, where policy is heading, and the one question to ask any vendor: real depth in the BOM types it claims to support, proven against an actual exported record.

AI Bill of Materials (AIBOM): The Complete Guide

What an AIBOM is, why the EU AI Act and US White House AI directives make it urgent, how to generate one with the OWASP AIBOM Generator, and how to manage AIBOMs at scale. By the co-lead of the OWASP AIBOM Initiative.

Welcome to the Reality of Supply Chain Attacks

Shai-Hulud is no longer only a malware story. It is a reminder that attackers can publish, package, and present hostile code like legitimate open source. Here is what security teams should learn from it.

Taip Halili

Data Services Engineer

HIPAA Compliance and SBOM Management: Why Software Transparency Matters

Modern HIPAA security expectations increasingly require evidence-based risk management. As software supply chain threats grow, SBOM management provides visibility into software components, strengthens vulnerability management, and improves third-party risk oversight.

AI Finds Vulnerabilities at Scale. SBOMs Are How You Find Your Exposure.

AI systems like Anthropic Mythos are rapidly increasing the speed and scale of vulnerability discovery, exposing a critical gap: most organizations still lack visibility into what software they run. This article explains why SBOMs are no longer optional but foundational for identifying exposure, understanding blast radius, and enabling real-time re

From Static Inventory to Real-Time Defense: Why the SBOM conversation has to change now

Claude Mythos Preview marks a paradigm shift in vulnerability discovery, exposing the limits of point in time scanning and increasing the need for SBOM continuous monitoring, impact analysis, and VEX-driven response.

Cryptography Bill of Materials (CBOM): Why Every Encryption Ecosystem Needs One - and Fast

A CBOM helps organizations identify, track, and manage cryptographic assets before AI-driven threats and quantum risks turn hidden weaknesses into major security problems.

The Trillion Dollar Cost of Ignorance: Why SBOMs Belong in Software Design

With IT failures costing the US economy 1.81 trillion in 2022, the industry faces a crisis of complexity. While SBOMs are often viewed only as security or licensing tools, this article argues they are actually the missing link in software design integrity.

Health-ISAC Summit Takeaways: FDA SBOM Requirements and Software Transparency in Healthcare

Healthcare is moving past “do SBOMs matter?” to “how do we do them well?” Key Health-ISAC takeaways: FDA SBOM requirements are driving action, and SBOMs need version numbers plus transitive dependencies to support real vulnerability management without exposing IP—especially critical for patient safety and resilience.

Cassie Crossley

Director, Board of Directors

Two npm Supply Chain Attacks in 13 Days: Nx, Then chalk and debug

In just 13 days, two supply chain attacks shook npm: Nx with 4.6M weekly downloads and Qix with 2.6B. Though the exploit window was short, the scale was massive. Early detection at 11:25 AM EDT gave customers a head start before public alerts.

Six SBOM Eras: From Denial to the Age of Adoption

Celebrating a new SBOM era! From early resistance to NTIA & CISA successes, this post tracks SBOM's evolution to an "Age of Adoption." Learn why SBOMs, with effective tools & management, are vital for software supply chain & medical device security.

HBOM, SBOM, CBOM and AI SBOM: What Each One Covers

Discover how Software Bills of Materials (SBOMs) boost software supply chain security by enhancing visibility, automating vulnerability management, and speeding incident response and compliance.

Why Facts Alone Don't Drive SBOM Adoption

Facts alone can't drive cybersecurity change: SBOM adoption stalls as bias, emotion, and storytelling matter.

Software Transparency Call to Action

SBOM Management: Strengthening Software Supply Chain Security

PCI DSS 4.0.1 and SBOMs: A Guide to Controls 6.3.2 and 11.3.1.1

Since 31 March 2025, PCI DSS 4.0.1 requires an inventory of bespoke and custom software and its third-party components (6.3.2) and the management of every lower-ranked scan finding (11.3.1.1). What assessors check and how to automate it.

Prevent Bad Actors from Hacking your SBOM

Fortify SBOM integrity with CycloneDX signing, hash validation, and continuous monitoring against omission spoofing and tampering essential for connected device compliance.

The Importance Of Validation In SBOM Generation

Tern is an open source software composition analysis and SBOM generation tool that generates SBOMs from container images. However, upon running this tool and generating a CycloneDX SBOM, a problem arose.

The Power of SBOMs: Building Resilience in Our Critical Infrastructure

As a member of the PCAST Working Group on Cyber-Physical Resilience, I was involved in crafting the recent report outlining crucial steps to fortify the intricate systems that underpin our daily lives. One of our key recommendations, "Recommendation 4B: Promote Supply Chain

Revolutionizing Healthcare Security: Health-ISAC and CyBeats Partnership in SBOM use-cases

Notably, the Health Information Sharing and Analysis Center (Health-ISAC) is entering into a partnership with CyBeats, a leading software supply chain intelligence company, marking a substantial advancement in healthcare cybersecurity.

Charting FDA's Course: SBOM as the North Star in Cybersecurity

FDA SBOM guidance positions SBOMs as a compliance framework for medical devices, enabling traceability, regulatory alignment, and vulnerability management.

Unlocking the Potential: How SBOM Practices Revolutionize Tech Industries

National Cybersecurity Strategy Implementation Plan (NCSIP) - Doubling Down on SBOM’s

We recently saw the publication of the National Cybersecurity Strategy Implementation Plan (NCSIP)

Unlock Compliance Excellence: Harness the Power of an SBOM to Conquer Import and Export Controls, Including OFAC Regulations.

Last month I wrote about using a Software Bill of Material (SBOM) as a valuable tool for managing cybersecurity risk.

Integrating SBOMs and Risk for Enhanced Cybersecurity Management

I’ve noticed that conversations on Software Bills of Materials (SBOMS) generally discuss what they are.

Top 7 SBOM Generation Tools and How to Choose

SBOM (Software Bill of Materials) is a comprehensive list of all the components that make up a piece of software

What Is an SBOM Generator and How and When Should You Generate SBOMs?

An SBOM generator is a tool or software that automatically creates a Software Bill of Materials (SBOM) for a software application.

What Is Executive Order 14028, Who Is Affected and How to Comply

On May 12, 2021, U.S. president Joe Biden issued an executive order on “Improving the Nation’s Cybersecurity”

How VEX supercharges SBOMs for a more secure software supply chain

Open-source code remains a concerning and ongoing source of vulnerability in the

CyBeats named by Gartner® as a Representative Vendor for SBOM Management tech in latest 2022 Emerging Tech Report

We believe CyBeats being recognized by Gartner further validates the leadership

5 Key takeaways from Microsoft and Google’s webinar on SBOM

Microsoft & Google SBOM webinar: automation, supply chain visibility, vulnerability prioritization, compliance best practices, and collaboration insights.

FDA cybersecurity guidance for medical devices

In April 2022, the Food and Drug Administration (FDA) and the Center for Devices and Radiological Health (CDRH) jointly published new guidance.

Security and Risk Report by Independent Research Firm

Cybeats is named in Forrester’s Planning Guide 2023, Security and Risk, released on August 23rd, 2022. Forrester, is one of the most reputable global research organizations.

What Could Possibly Go Wrong?

Common SBOM pitfalls: avoid incomplete inventories, outdated SBOMs, and ensure compliance with best practices for SBOM generation and vulnerability management.

Mesopotamian Roots of SBOM

We could blame Hammurabi for software supply chain hacking

Talking About Supply Chain Security

Software producers and consumers are actively implementing or pondering

Critical Infrastructure Protection: Risks and Best Practices

Critical infrastructure protection (CIP) involves securing networks, assets, and systems that must operate continuously to ensure the health and safety of regions, countries, or economies.

Medical Device Security: The Basics and 4 Best Practices

Medical device security refers to practices and techniques that can prevent attacks against medical devices. Attacks may involve unauthorized access or control of medical devices.

What is IoT Device Security? - Understanding IoT Device Security

IoT device security tools and best practices aim to provide coverage against IoT threats. As more sensitive data is stored on IoT devices, security becomes more complex.

Dmitry Raidman

CTO & Co-founder