Use Case

SBOM to improve
software supply chain security

Nowadays, applications are more assembled than built. Understanding and addressing the risk hidden in used open-source libraries is challenging. Hence, software supply chains can be alarmingly fragile.

Mandated by the US government for all its software vendors, a Software Bill of Materials (SBOM) aims to increase cybersecurity and helps DevSecOps better understand which software components their applications rely on. Yet, to achieve these goals, SBOMs must be viewed in the context of business operations, calling for a solution that emphasizes interoperability, ease of use, and fast time to value.

Cut down time to respond from days & weeks to minutes

Transparency for thousands of libraries put into service & team context

100% SBOM coverage for custom-built software

HOW IT WORKS

Safeguard your software supply chain with an SBOM-backed service catalog

Enhance visibility into the software supply chain

Automatically ingest SBOMs from CycloneDX
Quickly contextualize SBOMs by linking them to your teams, services and product(s) relying on these services
Efficiently consume the direct and transitive relations of software components in your inventory

Speed up response time

Easily query vulnerable libraries
Identify susceptible services and the teams that own them
Use tags to recommend remediation activities and rate the vulnerability

Collaboratively address open-source software risk

Highlight open-source software risk at the product level that’s based on missing library information
Surface the open-source software risk of self-build software across the application landscape by aggregating data to LeanIX EAM

Manage open-source risk of your application portfolio

Identify business capabilities supported by applications with high open-source software risk
Leverage these insights for your rationalization and governance processes

LeanIX VSM offers engineering leaders confidence by contextualizing open-source software risk and its associated impacts so they can efficiently prioritize remediation efforts.

Related resources

Blogpost

SBOM News: CISA Details New Open-Source Software Regulation

SBOMs have been under review by the US government for some time. Find out more about the latest guidance from CISA.

Blogpost

SBOM Now Vital For Open Source Software On Executive Order

SBOMs will soon be required for all software purchased by the US government. We put together a timeline of key dates and look at the future of SBOM use.

Blogpost

SBOMs: 5 Major Challenges In Implementation

SBOMs are becoming a requirement for value stream management. We look at the challenges you need to overcome in implementing SBOMs.

Blogpost

SBOMs: What Does EO 14028 Actually Mean For You?

Executive Order 14028 demands SBOM documentation from all vendors to the US government by September 2023. We look at what that means for your organization.