Automating SBOM Creation

The monumental increase in recent software supply chain attacks has prompted the US federal government and enterprises globally to require SBOMs as a standard business practice.

Why do you need an SBOM?

Over 70% of applications utilize open source software (OSS) components to speed up development cycles, but this introduces legal, security, and obsolescence risks, according to Gartner. The ubiquitous use of OSS in the software supply chain has increased organizations’ exposure to security attacks from hackers and legal action from IP owners. This has led organizations of all sizes globally to adopt a new standard for controlling open source risks requiring an SBOM to accompany any software being delivered, such as the recent cybersecurity executive order (EO) issued by the US federal government. Any business seeking to deliver software in today’s environment needs the ability to produce an SBOM with speed and accuracy.

What's in an SBOM?

Inventory of all open source components
Component details (version, release date, etc.)
Security vulnerabilities (CVEs) and criticality
Licenses and risk levels
Possible licensing conflicts
Transitive dependencies
Software weaknesses (CWEs)
Safer component version recommendations

See a sample SBOM

How do you automate SBOM creation?

CAST Highlight, a software intelligence product, plugs directly into source code repositories and analyzes applications in minutes, without disrupting developers. It performs Software Composition Analysis (SCA) of an application portfolio and automatically creates a full inventory of the 3rd party and Open Source components used within the codebase, including license versions. It highlights licensing exposures and security vulnerabilities as well as recommendations on the most critical remediations required. The SBOMs can be viewed and exported in Excel, Word, PPT, and CycloneDX.

Try CAST Highlight

Learn best practices for automating SBOMs from Broadridge

Learn More About CAST Highlight