# Education articles

## Pages

- [SBOM Adoption on PyPI Is at 1.58%. We Can Do Better.](https://sbomify.com/2026/03/12/pypi-sbom-analysis/) (2026-03-12): We scanned 15,021 of the most popular Python packages for PEP 770 SBOMs. Only 1.58% include one, and every single SBOM is CycloneDX. Here are the full results.
- [PEP 770: SBOMs Are Now a First-Class Citizen in Python Packages](https://sbomify.com/2026/03/05/pep-770-sboms-in-python-packages/) (2026-03-05): Python's PEP 770 standardizes shipping SBOMs inside packages via .dist-info/sboms/. Here's what it means and how we adopted it in two projects with minimal effort.
- [Why We're Bullish on TEA, And Why You Should Be Too](https://sbomify.com/2026/03/01/why-were-bullish-on-tea/) (2026-03-01): The Transparency Exchange API (TEA) is the missing standard for automated SBOM discovery and exchange. Here's what it is, why it matters, and why sbomify is all in.
- [The Role of SBOMs in Cybersecurity: From Visibility to Vulnerability Response](https://sbomify.com/2026/02/08/sbom-cybersecurity-role/) (2026-02-08): Learn how SBOMs strengthen cybersecurity through component visibility, vulnerability management, incident response, and compliance with EO 14028, EU CRA, and more.
- [What Is CVSS? Understanding Vulnerability Severity Scoring](https://sbomify.com/2026/02/05/what-is-cvss-vulnerability-scoring/) (2026-02-05): Learn what CVSS is, how vulnerability severity scores are calculated, the differences between CVSS v3.1 and v4.0, and how to use CVSS with KEV and SBOMs for prioritization.
- [SBOM Scanning: How to Detect Vulnerabilities in Your Software Components](https://sbomify.com/2026/02/01/sbom-scanning-vulnerability-detection/) (2026-02-01): Learn how SBOM scanning works, which tools to use, how to set up continuous vulnerability monitoring, and how to act on scan results effectively.
- [What Is a Dependency in Software? A Beginner's Guide](https://sbomify.com/2026/01/29/what-is-a-dependency-in-software/) (2026-01-29): Learn what software dependencies are, the difference between direct and transitive dependencies, how dependency trees work, and how SBOMs document them.
- [SBOM Generation Tools Compared: Syft, Trivy, cdxgen, and More](https://sbomify.com/2026/01/26/sbom-generation-tools-comparison/) (2026-01-26): Compare the leading SBOM generation tools – Syft, Trivy, cdxgen, Microsoft SBOM Tool, and CycloneDX CLI – covering format support, ecosystems, and CI/CD integration.
- [The MIT License: A Complete Guide for Developers](https://sbomify.com/2026/01/22/mit-license-guide/) (2026-01-22): Understand the MIT License – what it permits, what it requires, how it compares to BSD and Apache 2.0, and how SBOMs help track MIT license compliance.
- [SBOM Management: How to Organize, Track, and Act on Your SBOMs](https://sbomify.com/2026/01/18/sbom-management-best-practices/) (2026-01-18): Learn how to manage SBOMs across the full lifecycle – from generation and storage to vulnerability monitoring, versioning, and distribution to consumers.
- [SBOM Formats Compared: CycloneDX vs SPDX](https://sbomify.com/2026/01/15/sbom-formats-cyclonedx-vs-spdx/) (2026-01-15): A practical comparison of CycloneDX and SPDX SBOM formats covering history, governance, field differences, tooling, compliance preferences, and when to use which.
- [Software Composition Analysis (SCA): What It Is and How SBOMs Fit In](https://sbomify.com/2026/01/11/software-composition-analysis-sca/) (2026-01-11): Learn what software composition analysis is, how SCA tools work, how SCA compares to SAST and DAST, and how SBOMs complement SCA for full supply chain visibility.
- [Apache License 2.0: What It Is, How It Works, and What It Means for Your Software](https://sbomify.com/2026/01/07/apache-license-2-guide/) (2026-01-07): Understand the Apache License 2.0, its patent grant, attribution requirements, NOTICE file, compatibility with GPL, and how SBOMs track compliance.
- [Container Security: Best Practices for Securing Docker and Kubernetes](https://sbomify.com/2026/01/03/container-security-best-practices/) (2026-01-03): A comprehensive guide to container security covering image scanning, runtime protection, network policies, and how SBOMs provide component visibility.
- [What Is a KEV? Understanding CISA's Known Exploited Vulnerabilities Catalog](https://sbomify.com/2025/12/30/what-is-kev-cisa-known-exploited-vulnerabilities/) (2025-12-30): What is a KEV? CISA's Known Exploited Vulnerabilities catalog lists CVEs under active attack. Learn how KEV differs from CVE and CVSS, and how SBOMs automate KEV monitoring.
- [Software Supply Chain Management: Risks, Best Practices, and SBOM Integration](https://sbomify.com/2025/12/26/software-supply-chain-management/) (2025-12-26): Learn what software supply chain management is, how attacks like Log4Shell and XZ Utils exploit it, and how SBOMs provide visibility and risk reduction.
- [The GPL License: A Comprehensive Guide to the GNU General Public License](https://sbomify.com/2025/12/22/gpl-license-guide/) (2025-12-22): Understand the GPL license, including GPL v2 vs v3, copyleft obligations, LGPL, AGPL, commercial use, and how SBOMs track GPL compliance.
- [CVE Vulnerabilities Explained: What They Are and Why They Matter](https://sbomify.com/2025/12/18/cve-vulnerability-explained/) (2025-12-18): Learn what CVE vulnerabilities are, how the CVE system works, the role of MITRE and NVD, and how SBOMs enable rapid vulnerability response.
- [Software Development Life Cycle (SDLC): A Complete Guide](https://sbomify.com/2025/12/15/software-development-life-cycle-sdlc-sbom-integration/) (2025-12-15): Learn what the Software Development Life Cycle (SDLC) is, its phases and models, and how SBOMs integrate into each stage for security and compliance.
- [Comparing SBOM Formats: Focus on Component Types in CycloneDX vs. SPDX](https://sbomify.com/2024/08/20/sbom-component-types/) (2024-08-20): A detailed comparison of CycloneDX and SPDX SBOM formats, analyzing their support for applications, libraries, containers, operating systems, and SaaS components.
- [What Is SLSA? Understanding Supply Chain Levels for Software Artifacts](https://sbomify.com/2024/08/17/what-is-slsa/) (2024-08-17): What is SLSA? The OpenSSF framework for software supply chain security defines three build levels for provenance and integrity. Learn how SLSA works, how it builds on in-toto, and how to adopt it with GitHub Actions.
- [What Is in-toto? Securing the Software Supply Chain End to End](https://sbomify.com/2024/08/14/what-is-in-toto/) (2024-08-14): What is in-toto? The CNCF-graduated framework uses layouts, signed link metadata, and end-to-end verification to cryptographically prove every build step happened as intended. Learn how it underpins SLSA, GitHub attestations, and SBOM integrity.
- [What Is Sigstore? Keyless Signing for the Software Supply Chain](https://sbomify.com/2024/08/12/what-is-sigstore/) (2024-08-12): What is Sigstore? The CNCF-graduated project makes cryptographic signing effortless with keyless signing via Fulcio, transparency logging via Rekor, and container signing via Cosign. Learn how Sigstore secures artifacts, SBOMs, and supply chains.
- [What Is Lock File Drift? A Hidden Risk in Dependency Management](https://sbomify.com/2024/07/30/what-is-lock-file-drift/) (2024-07-30): What is lock file drift? When your dependency manifest and lock file fall out of sync, builds become unreproducible and SBOMs become inaccurate. Learn how to detect, prevent, and fix lock file drift across npm, Python, Go, Rust, and more.
- [What's New in SPDX 3: Enhanced Referencing Capabilities](https://sbomify.com/2024/07/22/whats-new-in-spdx-3-enhanced-referencing-capabilities/) (2024-07-22): SPDX 3 draft introduces nested references, cross-document references, and improved relationship types to match CycloneDX capabilities for complex SBOM management.
- [The Role of SBOMs in an OBOM: Ensuring Compliance and Security in Smart Thermometer Development](https://sbomify.com/2024/07/09/the-role-of-sboms-in-an-obom-ensuring-compliance-and-security-in-smart-thermometer-development/) (2024-07-09): How to integrate SBOMs into Operations Bill of Materials (OBOM) for IoT devices, using a smart thermometer example with Python backend, Docker, and Rust firmware.
- [Enhancing Dependency Management with GitHub's Dependency Graph: An Analysis](https://sbomify.com/2024/06/24/enhancing-dependency-management-with-githubs-dependency-graph-an-analysis/) (2024-06-24): Research analysis revealing inaccuracies in GitHub's dependency graph for Java and Python projects, with implications for Dependabot and SBOM generators.
- [Framing Software Component Transparency: Establishing a Common Software Bill of Materials (SBOM)](https://sbomify.com/2024/06/11/framing-software-component-transparency-establishing-a-common-software-bill-of-materials-sbom/) (2024-06-11): Summary of NTIA's SBOM Framing document 2nd edition highlighting transparency, interoperability standards, and what to expect in the upcoming 3rd edition.
- [Enhancing SBOM Sharing: A Look at Current Practices and the Role of sbomify](https://sbomify.com/2024/05/13/enhancing-sbom-sharing-a-look-at-current-practices-and-the-role-of-sbomify/) (2024-05-13): Analysis of CISA's SBOM Sharing Primer examining current SBOM sharing methods from email to automated tooling, and how sbomify simplifies the distribution process.
- [Exploring the New SPDX 3.0: A Game Changer for SBOMs](https://sbomify.com/2024/04/28/exploring-the-new-spdx-3-0-a-game-changer-for-sboms/) (2024-04-28): Overview of SPDX 3.0 improvements including enhanced compatibility, improved accuracy, streamlined automation, and broader software package support for SBOM generation.
- [What Is OpenSSF? Scorecards, SLSA, and the Open Source Security Ecosystem](https://sbomify.com/2024/04/25/openssf-and-openssf-scorecards-bolstering-open-source-security/) (2024-04-25): What is OpenSSF? The Open Source Security Foundation coordinates industry-wide efforts to secure open source software. Learn about OpenSSF Scorecards, how to run them, what they measure, and how they connect to SBOMs, SLSA, and supply chain security.
- [Elevate Your Cybersecurity with Our Leading SBOM Management Solution](https://sbomify.com/2024/04/12/elevate-your-cybersecurity-with-our-leading-sbom-management-solution/) (2024-04-12): How sbomify's SBOM management platform helps organizations comply with Executive Order 14028 through comprehensive visibility, vulnerability management, and streamlined reporting.
- [What Is a CBOM? The Cryptography Bill of Materials Explained](https://sbomify.com/2024/04/10/future-proofing-cybersecurity-with-the-cryptography-bill-of-materials-cbom/) (2024-04-10): What is a CBOM? The Cryptography Bill of Materials inventories every cryptographic asset in your software – algorithms, keys, certificates, and protocols. Learn how CBOMs prepare organizations for the post-quantum transition.
- [SBOM Management for Software Vendors: A Complete Guide to sbomify](https://sbomify.com/2024/04/03/sbomify-a-paradigm-shift-for-software-vendors-in-sbom-management/) (2024-04-03): How software vendors use sbomify to generate compliance-ready SBOMs in CI/CD, enrich them with 11 data sources, attest with GitHub Actions, and share via Trust Center – all from an open source GitHub Action.
- [Navigating the Landscape of Open Source Licenses](https://sbomify.com/2024/04/03/navigating-the-landscape-of-open-source-licenses/) (2024-04-03): Comprehensive guide to open source licenses including MIT, Apache 2.0, GPL, BSD, MPL, and more. Learn the differences between permissive and copyleft licenses and how SBOMs help with license compliance.
- [Enhancing SBOM Management for Software Buyers with sbomify](https://sbomify.com/2024/04/03/enhancing-sbom-management-for-buyers-with-sbomify/) (2024-04-03): How sbomify helps CTOs and CISOs manage SBOMs from software vendors – with Trust Center access, vulnerability monitoring, license compliance, and SBOM hierarchy for complex supply chains.
- [Demystifying SBOMs: The Backbone of Modern Software Security](https://sbomify.com/2024/04/03/demystifying-sboms-the-backbone-of-modern-software-security/) (2024-04-03): What is an SBOM? A Software Bill of Materials is a machine-readable inventory of every component in your software. Learn about SBOM formats (SPDX, CycloneDX), generation tools, vulnerability management, and compliance requirements.

---

From sbomify: https://sbomify.com/categories/education/