The software half
CycloneDX ingest, components deduplicated by package URL, releases, deployments and licence policy.
Bill of materials
What a bill of materials is, and why one register beats two
BOM, SBOM and HBOM are the same idea applied to different things: an honest list of what something is made of. The distinction that matters is not the acronym — it is whether the list is joined to what you actually run.
The three terms, plainly
The vocabulary has grown faster than the practice, and vendors use the words loosely. Here is what each one means and what it is for.
| Term | Lists | Answers |
|---|---|---|
| BOM bill of materials | The parts of anything. The general term, borrowed from manufacturing. | What is this made of? |
| SBOM software bill of materials | Components inside one software release: library, version, supplier, licence, and often a package URL that identifies it exactly. | What is inside what we ship, and who supplied it? |
| HBOM hardware bill of materials | Physical assets: laptops, servers, network kit, their serials, who holds them and what state each is in. | What do we own, where is it, and who is responsible? |
| VEX vulnerability exploitability exchange | A position on a specific vulnerability in a specific product: affected, not affected, fixed, or under investigation, with the reasoning. | This CVE appears in our SBOM — does it actually affect us? |
Why this became everybody's problem
Modern software is assembled, not written. A typical service is a few thousand lines of your own code sitting on several hundred dependencies you did not write, each with its own dependencies. When a flaw is found in one of them, the question is not whether you are affected in principle — it is which of the things you run contain it, and how fast you can say so.
Log4Shell made that concrete for a lot of organisations in December 2021. The difference between the teams who patched in hours and the teams who spent a fortnight was not skill. It was whether anybody had written down what was inside what they shipped, and where those things were running.
Regulation followed. US Executive Order 14028 made SBOMs a condition of federal software procurement. The EU Cyber Resilience Act obliges manufacturers of products with digital elements to maintain a bill of materials and to handle vulnerabilities for the supported life of the product. Private buyers now ask in due diligence whether or not a statute compels them.
A list is not yet an answer
Most tooling stops at generating the document. That is the easy half. A bill of materials earns its keep when four things are true of it, and each one is a place real deployments fall down.
- It is current. An SBOM generated once at a release you no longer run describes history. A scan is only as current as the advisory feeds behind it, so a CVE published today lands in a component you ingested months ago and nothing tells you unless something re-scans.
- It is attested. A document regenerated from a database years later is not the artefact your build produced. If the bytes and their digest are not retained, "prove this is the SBOM CI emitted" has no answer.
- It is joined to deployment. Without the map from release to environment to machine, every finding has the same urgency, which in practice means none of them do.
- It records decisions, not just facts. Most findings turn out not to apply. Unless the reasoning is written down at the time and attributed, the same triage is redone every quarter and the auditor is told "we looked into it".
One register, because the question crosses the line
The market splits along an old boundary: IT asset management tools own hardware, software composition analysis tools own dependencies. Both are mature and neither answers the question an incident actually poses, because that question spans them.
provenance keeps both halves in one register, joined by a deployment map. A component belongs to releases; a release is deployed into an environment and optionally onto a named machine from the hardware register; that machine has a custodian, a site and a lifecycle. So "this library is vulnerable" resolves, in one lookup, to a list of boxes and the people responsible for them.
The hardware half
Devices with a full lifecycle, custodians, encryption evidence, point-in-time history and certified disposal.
Where they meet
Findings ranked by whether the affected release is deployed, with VEX positions a person approves.
Bill of materials: common questions
What is a bill of materials?
A list of everything a thing is made of, precise enough that someone else could account for each part. The term comes from manufacturing, where a BOM lists the components of a physical product. In technology it now covers two distinct things: the components inside software you ship, and the physical estate you own.
What is the difference between a BOM and an SBOM?
An SBOM — a software bill of materials — is a bill of materials for a piece of software. It lists the libraries, versions, suppliers and licences inside a particular build. A BOM is the general term; an SBOM is the software case of it, and an HBOM is the hardware case.
Is an SBOM legally required?
Increasingly, in effect. US Executive Order 14028 made SBOMs a condition of selling software to federal agencies, and the EU Cyber Resilience Act obliges manufacturers of products with digital elements to keep one and to handle vulnerabilities across the product lifetime. Many private buyers now ask for one in due diligence regardless of any statute.
What makes a bill of materials actually useful?
Being current, being complete, and being joined to reality. A list of dependencies with no link to which release shipped them, and which of those releases is running where, cannot answer the only question that matters during an incident. That join is what turns an inventory into an answer.
Why keep hardware and software in one register?
Because the urgent questions cross the boundary. "A critical vulnerability is in this library" becomes actionable only when you can say which releases contain it, which of those are deployed, and which machines are running them. If the hardware register and the software inventory are separate systems, that join is done by a human under time pressure, usually in a spreadsheet.
See it against your own estate
Free for personal use. For an organisation, tell us the size of the estate and what you need to evidence.