PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

SBOMs in 2026: Everyone's generating them, no one's using them

aikido.dev | blog | #supply-chain | #compliance | #enisa | #supply-chain-security | #cra | #software-supply-chain | #sbom
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

ENISA's survey of 334 organizations shows the CRA drives SBOM adoption, but use lags generation: most SBOMs serve compliance only, and 39% of buyers never receive SBOMs from suppliers.
Published
Collected

Related coverage

blog · aikido.dev
Cyber Resilience Act is here! Myth busting and first impressions
Aikido Security's first impressions of the EU Cyber Resilience Act's first reporting deadline, covering the new Single Reporting Platform, its 24/72-hour and 14-day timelines, and compliance myths.
blog · hackerone.com
EU CRA Reporting Goes Live This Friday. Are You Ready?
The EU Cyber Resilience Act's mandatory reporting starts September 11: manufacturers must warn ENISA of exploited vulnerabilities within 24 hours, notify within 72, and then file follow-up reports.
blog · hackerone.com
European Council Adopts Cyber Resilience Act
The EU Council adopted the Cyber Resilience Act, requiring manufacturers to adopt coordinated vulnerability disclosure, patch promptly, report actively exploited flaws to ENISA, and provide SBOMs.
blog · hackenproof.com
Vulnerability Disclosure Policy: A Guide for Business Leaders
Explains what a vulnerability disclosure policy is and why the EU CRA and NIS2 now make it a compliance expectation, then walks through the key decisions behind each policy section, offering a free template for security and legal teams to adapt.
blog · wiz.io
Finding the needle in the haystack: effortless SBOM search in your cloud with Wiz
Wiz adds SBOM search across cloud environments: locate any OS package or open-source library and its version to find vulnerable or obsolete components and plan remediation.
research · eshard.com
What does the EU Cyber Resilience Act (CRA) mean for connected device manufacturers?
The Cyber Resilience Act is a new legislation proposed by the European Commission to improve the cybersecurity posture of organisations using digital assets.
Back