Announcement
Announcing sbomify v26.7.0: The One That Gets Quantum-Ready
Most of the SBOM world is focused on one question: what software am I shipping? v26.7.0 adds a second question that is about to matter a...
Announcement
Announcing sbomify v26.3.0: The One That Ditches the Token
The headline of v26.3.0 is about getting rid of something: the long-lived API token sitting in your CI secrets. With GitHub Actions OIDC...
Education
What Is CVSS? Understanding Vulnerability Severity Scoring
The Common Vulnerability Scoring System (CVSS) is an open framework for communicating the severity of software vulnerabilities. Published...
Education
SBOM Scanning: How to Detect Vulnerabilities in Your Software Components
SBOM scanning is the process of analyzing a Software Bill of Materials to identify known vulnerabilities, license issues, and other risks in...
Education
What Is a Dependency in Software? A Beginner's Guide
A dependency in software is any external component – a library, framework, module, or package – that your application relies on to function....
Education
Software Composition Analysis (SCA): What It Is and How SBOMs Fit In
Software Composition Analysis (SCA) is a category of application security tooling that identifies open source and third-party components in...
Podcast
CRA Explained: What the Cyber Resilience Act Means for Device Manufacturers
The EU Cyber Resilience Act (CRA) is transforming how device manufacturers approach cybersecurity. To break down what this means in...
Education
Container Security: Best Practices for Securing Docker and Kubernetes
Container security is the practice of protecting containerized applications and their infrastructure throughout the entire lifecycle – from...
Education
What Is a KEV? Understanding CISA's Known Exploited Vulnerabilities Catalog
A KEV – Known Exploited Vulnerability – is a vulnerability that attackers are exploiting right now. When Apache Log4Shell (CVE-2021-44228)...
Education
Software Supply Chain Management: Risks, Best Practices, and SBOM Integration
Software supply chain management is the practice of identifying, assessing, and mitigating risks across the entire chain of components,...
Education
CVE Vulnerabilities Explained: What They Are and Why They Matter
A CVE (Common Vulnerabilities and Exposures) is a standardized identifier assigned to a publicly known cybersecurity vulnerability. Each CVE...
Education
Software Development Life Cycle (SDLC): A Complete Guide
The Software Development Life Cycle (SDLC) is a structured process that defines the stages involved in developing software from initial...