The Growing Importance of SBOMs in Cybersecurity: A Future Driven by AI
In the rapidly evolving landscape of software development, open-source code has emerged as a fundamental building block. Recent findings from cybersecurity vendor Black Duck reveal that an astonishing 98% of modern codebases incorporate open-source elements. This statistic stems from an extensive examination of 947 codebases and nearly 3,000 individual projects conducted between November 2024 and October 2025. The implications are significant, as the various open-source components are in a state of constant flux, receiving updates, patches, and new versions that challenge organizations to keep pace.
At the heart of addressing these challenges lies the concept of a Software Bill of Materials (SBOM). This vital document serves as a comprehensive snapshot of an organization’s software inventory, allowing companies to quickly locate and remedy vulnerabilities. However, the dynamic nature of software development means that an SBOM can quickly become outdated. The moment a developer merges a dependency update or a new version is pulled into a build, the document risks drifting from reality. Stale SBOMs can give organizations a false sense of security, potentially hindering essential responses when vulnerabilities arise.
The issue is further complicated by regulatory pressures. Starting September 11, 2026, the EU Cyber Resilience Act mandates that organizations must report actively exploited vulnerabilities. By December 11, 2027, manufacturers of digital products will be required to include machine-readable SBOMs in their technical documentation. Failure to comply could result in penalties of up to 15 million euros or 2.5% of a company’s global annual turnover. In the United States, the Cybersecurity and Infrastructure Security Agency (CISA) and its partners issued joint SBOM guidance in September 2025, advocating for broader adoption of these essential documents. As demand for compliance increases, AI-driven tools have surfaced as a potent solution, giving organizations the capability to maintain SBOMs at scale.
AI tools reframe the SBOM as a living entity, moving beyond the traditional notion of a static report. These systems leverage automation and machine learning across four critical functions that enhance their effectiveness. Continuous generation is one such feature, which integrates the SBOM generation into the Continuous Integration/Continuous Deployment (CI/CD) pipeline. This means that the SBOM is regenerated with every build, ensuring that the inventory remains aligned with each release.
In addition, component identification utilizes advanced machine learning techniques, including natural language processing and graph neural networks, to classify components and track transitive dependencies. Remarkably, one multi-model system reported a 94.7% success rate in component detection along with a 91.3% accuracy in mapping vulnerabilities.
The third function, drift detection, enables AI-driven tools to compare the SBOM generated at build time with the actual components running in production. By identifying unauthorized packages and potential supply chain tampering, organizations can take preemptive measures against threats. Lastly, the vulnerability correlation feature enriches each component with relevant intelligence regarding exploitability and ranks vulnerabilities based on their reachability, rather than simply presenting raw counts from the Common Vulnerabilities and Exposures (CVE) database. This prioritization allows organizations to address the most critical issues first.
CISOs (Chief Information Security Officers) recognize the advantages that AI brings to SBOM creation and maintenance. The accuracy achieved at scale is unparalleled, with AI significantly reducing the time it takes to update inventories across hundreds of repositories—an impossible task for human teams. Moreover, when serious vulnerabilities emerge—akin to the notorious Log4Shell incident—having an accurate and current inventory allows organizations to ascertain their risk status in minutes instead of days.
While AI presents numerous opportunities, it is essential to maintain a level of human oversight and judgment. Risks exist in the form of false positives and negatives generated by automated tools, emphasizing the need for human reviews alongside automated systems. Additionally, the opacity of AI models can make it challenging to audit a decision-making process, underscoring the necessity for explainable outputs. The quality of data further influences the effectiveness of AI in maintaining an SBOM; inaccuracies in package metadata or incomplete scans can result in misleading inventories.
CISOs should approach the integration of AI into SBOM management with caution, observing a set of best practices. They are encouraged to embed SBOM generation within their CI/CD pipelines, facilitate continuous monitoring of build-time and runtime discrepancies, and require that findings be supported by explainable outputs. By prioritizing vulnerabilities based on reachability over mere CVE counts, organizations can focus their resources more judiciously.
Additionally, as organizations embark on this transformative journey, they must avoid potential pitfalls, treating the SBOM as a dynamic document rather than a one-off artifact. Vigilance is essential; organizations should not become overly reliant on automated outputs, and they must be proactive in verifying the integrity of runtime discrepancies.
Ultimately, maintaining an up-to-date SBOM is foundational for software supply chain security. By harnessing AI to enhance the accuracy, speed, and compliance of SBOM management, organizations can shift from merely fulfilling regulatory demands to cultivating a robust and proactive approach to their cybersecurity landscape.
As cybersecurity continues to evolve, the integration of AI tools with human vigilance will serve as a cornerstone to effectively managing supply-chain risks and ensuring compliance in an increasingly complicated digital environment.