Tech

Why can I not know if what is running matches what my SBOM declared?

Opportunity

SBOMs are generated at build time and describe what a build claimed to contain. By the time software is deployed and running, dependencies may have drifted, statically linked libraries leave no runtime trace, and there is no standard primitive to verify that a live process matches its declared bill of materials. IBM's 2025 analysis of over 35,000 SBOMs found 7,907 failed to disclose direct dependencies, and ENISA's December 2025 implementation guide calls runtime drift one of the core open gaps. The gap between a signed SBOM and a running container is currently bridged by trust alone.

Why it matters

Regulations in the EU and US now mandate SBOMs, but without runtime attestation they are an audit artifact, not a security control.

機会をどう評価するか

The Opportunity Score is my own read, not a measurement: how much it hurts, how often it bites, and how little exists to solve it today. Higher means I think it is more worth building.

深刻度9/10

How much pain it causes when it shows up.

頻度8/10

How often people actually run into it.

ホワイトスペース8/10

How little good tooling exists for it today.