SecAppDev original
SBOMs and their Role in Security
Video and handoutsSecAppDev 2026
-
Abstract
A practical deep dive into Software Bills of Materials (SBOMs): what they are, what they are not, and how they fit into modern software security. We will cover common data models and formats, how SBOMs are produced and consumed, and how they enable better visibility and faster decision-making across the software lifecycle. Interactive participation is particularly encouraged.
Handouts available for this lecture
DownloadChapters
- Introduction and SBOM basics
- SBOM producers, consumers, and use cases
- Legal, export, and security drivers
- Regulation and minimum viable SBOMs
- Delivering SBOM data and standardization
- SPDX, CycloneDX, and format wars
- Naming software components and identifiers
- Package URLs (PURL)
- Software Hash Identifiers (SWHID)
- The SPDX project and graph-based data
- RDF, triples, and serializations
- Security content, vulnerabilities, and VEX
- Licensing, AI, and other SBOM data
- SBOM lifecycle types and tooling
- Open issues and final thoughts
In-person course
Alexios Zavras taught at a previous edition of SecAppDev
SecAppDev is an immersive course in secure application development, running annually since 2005. World-renowned faculty from industry and academia deliver in-depth 90-minute lectures and full-day workshops in an intimate setting, typically in early June.
More about SecAppDev