# Security articles

## Pages

- [Announcing sbomify v26.7.0: The One That Gets Quantum-Ready](https://sbomify.com/2026/07/07/announcing-sbomify-v26-7-0-the-one-that-gets-quantum-ready/) (2026-07-07): sbomify v26.7.0 adds Cryptography BOM (CBOM) support with NIST-grounded post-quantum readiness assessment, per-token API rate limiting with audit logging, a rebuilt authorization layer, and a broad security hardening pass.
- [Announcing sbomify v26.3.0: The One That Ditches the Token](https://sbomify.com/2026/06/12/announcing-sbomify-v26-3-0-the-one-that-ditches-the-token/) (2026-06-12): sbomify v26.3.0 adds GitHub Actions OIDC trusted publishing so you can push SBOMs with no long-lived API token, expires personal access tokens by default, removes the Project layer, and ships a broad security and access-control hardening pass.
- [What Is CVSS? Understanding Vulnerability Severity Scoring](https://sbomify.com/2026/02/05/what-is-cvss-vulnerability-scoring/) (2026-02-05): Learn what CVSS is, how vulnerability severity scores are calculated, the differences between CVSS v3.1 and v4.0, and how to use CVSS with KEV and SBOMs for prioritization.
- [SBOM Scanning: How to Detect Vulnerabilities in Your Software Components](https://sbomify.com/2026/02/01/sbom-scanning-vulnerability-detection/) (2026-02-01): Learn how SBOM scanning works, which tools to use, how to set up continuous vulnerability monitoring, and how to act on scan results effectively.
- [What Is a Dependency in Software? A Beginner's Guide](https://sbomify.com/2026/01/29/what-is-a-dependency-in-software/) (2026-01-29): Learn what software dependencies are, the difference between direct and transitive dependencies, how dependency trees work, and how SBOMs document them.
- [Software Composition Analysis (SCA): What It Is and How SBOMs Fit In](https://sbomify.com/2026/01/11/software-composition-analysis-sca/) (2026-01-11): Learn what software composition analysis is, how SCA tools work, how SCA compares to SAST and DAST, and how SBOMs complement SCA for full supply chain visibility.
- [CRA Explained: What the Cyber Resilience Act Means for Device Manufacturers](https://sbomify.com/2026/01/06/cra-explained-cyber-resilience-act-for-device-manufacturers/) (2026-01-06): Podcast episode with EU CRA expert Sarah Fluchs explaining SBOM requirements, the 5-year support mandate, and vulnerability management for device manufacturers.
- [Container Security: Best Practices for Securing Docker and Kubernetes](https://sbomify.com/2026/01/03/container-security-best-practices/) (2026-01-03): A comprehensive guide to container security covering image scanning, runtime protection, network policies, and how SBOMs provide component visibility.
- [What Is a KEV? Understanding CISA's Known Exploited Vulnerabilities Catalog](https://sbomify.com/2025/12/30/what-is-kev-cisa-known-exploited-vulnerabilities/) (2025-12-30): What is a KEV? CISA's Known Exploited Vulnerabilities catalog lists CVEs under active attack. Learn how KEV differs from CVE and CVSS, and how SBOMs automate KEV monitoring.
- [Software Supply Chain Management: Risks, Best Practices, and SBOM Integration](https://sbomify.com/2025/12/26/software-supply-chain-management/) (2025-12-26): Learn what software supply chain management is, how attacks like Log4Shell and XZ Utils exploit it, and how SBOMs provide visibility and risk reduction.
- [CVE Vulnerabilities Explained: What They Are and Why They Matter](https://sbomify.com/2025/12/18/cve-vulnerability-explained/) (2025-12-18): Learn what CVE vulnerabilities are, how the CVE system works, the role of MITRE and NVD, and how SBOMs enable rapid vulnerability response.
- [Software Development Life Cycle (SDLC): A Complete Guide](https://sbomify.com/2025/12/15/software-development-life-cycle-sdlc-sbom-integration/) (2025-12-15): Learn what the Software Development Life Cycle (SDLC) is, its phases and models, and how SBOMs integrate into each stage for security and compliance.
- [How SBOMs Can Help You Achieve PCI DSS 4.0 Compliance](https://sbomify.com/2025/01/07/how-sboms-can-help-you-achieve-pci-dss-4-compliance/) (2025-01-07): Discover how Software Bill of Materials (SBOMs) help online gambling and e-commerce businesses achieve PCI DSS 4.0 compliance through better vulnerability management and audit trails.
- [Introducing sbomify: Revolutionizing SBOM Management](https://sbomify.com/2024/08/29/launching-sbomify/) (2024-08-29): Announcing the launch of sbomify, a platform for automated SBOM management and sharing that integrates with CI/CD pipelines to ensure stakeholders always have the latest SBOMs.
- [Exploring the Future of Software Security: Join Us at BSides Bristol](https://sbomify.com/2024/08/26/bsides-bristol/) (2024-08-26): sbomify presents 'Navigating the SBOM Landscape: Formats, Relevance, and Tooling in 2024' at BSides Bristol, covering SPDX, CycloneDX, and current SBOM tooling.
- [Announcing sbomify's GitHub Actions Module: Seamlessly Share SBOMs in Your CI/CD Pipeline](https://sbomify.com/2024/08/21/introducing-github-action-module/) (2024-08-21): Introducing sbomify's GitHub Actions module for automated SBOM generation in your CI/CD pipeline. Available on GitHub Marketplace for seamless integration.
- [Comparing SBOM Formats: Focus on Component Types in CycloneDX vs. SPDX](https://sbomify.com/2024/08/20/sbom-component-types/) (2024-08-20): A detailed comparison of CycloneDX and SPDX SBOM formats, analyzing their support for applications, libraries, containers, operating systems, and SaaS components.
- [What Is SLSA? Understanding Supply Chain Levels for Software Artifacts](https://sbomify.com/2024/08/17/what-is-slsa/) (2024-08-17): What is SLSA? The OpenSSF framework for software supply chain security defines three build levels for provenance and integrity. Learn how SLSA works, how it builds on in-toto, and how to adopt it with GitHub Actions.
- [What Is in-toto? Securing the Software Supply Chain End to End](https://sbomify.com/2024/08/14/what-is-in-toto/) (2024-08-14): What is in-toto? The CNCF-graduated framework uses layouts, signed link metadata, and end-to-end verification to cryptographically prove every build step happened as intended. Learn how it underpins SLSA, GitHub attestations, and SBOM integrity.
- [What Is Sigstore? Keyless Signing for the Software Supply Chain](https://sbomify.com/2024/08/12/what-is-sigstore/) (2024-08-12): What is Sigstore? The CNCF-graduated project makes cryptographic signing effortless with keyless signing via Fulcio, transparency logging via Rekor, and container signing via Cosign. Learn how Sigstore secures artifacts, SBOMs, and supply chains.
- [How to Generate SBOMs for Python Packages with `pipdeptree` and `cyclonedx-py`](https://sbomify.com/2024/07/30/generate-sboms-for-python-packages-with-pipdeptree-and-cyclonedx-py/) (2024-07-30): Tutorial on generating CycloneDX SBOMs for Python projects using pipdeptree and cyclonedx-py, including transitive dependencies and best practices for pinning with hashes.
- [What Is Lock File Drift? A Hidden Risk in Dependency Management](https://sbomify.com/2024/07/30/what-is-lock-file-drift/) (2024-07-30): What is lock file drift? When your dependency manifest and lock file fall out of sync, builds become unreproducible and SBOMs become inaccurate. Learn how to detect, prevent, and fix lock file drift across npm, Python, Go, Rust, and more.
- [Embracing Cybersecurity with CISA's 'Secure by Design' Initiative](https://sbomify.com/2024/07/24/embracing-cybersecurity-with-cisas-secure-by-design-initiative/) (2024-07-24): Overview of CISA's Secure by Design guide, its three core principles for software manufacturers, and practical steps for implementing security from the start.
- [Enhancing Dependency Management with GitHub's Dependency Graph: An Analysis](https://sbomify.com/2024/06/24/enhancing-dependency-management-with-githubs-dependency-graph-an-analysis/) (2024-06-24): Research analysis revealing inaccuracies in GitHub's dependency graph for Java and Python projects, with implications for Dependabot and SBOM generators.
- [Call for Views on the Code of Practice for Software Vendors: Ensuring Security and Resilience](https://sbomify.com/2024/05/26/call-for-views-on-the-code-of-practice-for-software-vendors-ensuring-security-and-resilience/) (2024-05-26): UK government launches consultation on voluntary Code of Practice for Software Vendors to enhance security and resilience of digital products sold to businesses.
- [Harnessing ISO 27001 and SBOMs for Enhanced Information Security Management](https://sbomify.com/2024/04/29/harnessing-iso-27001-and-sboms-for-enhanced-information-security-management/) (2024-04-29): How to integrate SBOMs into ISO 27001 information security management systems for better risk assessment, compliance auditing, and vendor management.
- [What Is OpenSSF? Scorecards, SLSA, and the Open Source Security Ecosystem](https://sbomify.com/2024/04/25/openssf-and-openssf-scorecards-bolstering-open-source-security/) (2024-04-25): What is OpenSSF? The Open Source Security Foundation coordinates industry-wide efforts to secure open source software. Learn about OpenSSF Scorecards, how to run them, what they measure, and how they connect to SBOMs, SLSA, and supply chain security.
- [How SBOMs Streamline SOC 2 Compliance: Insights for the Agile Enterprise](https://sbomify.com/2024/04/23/how-sboms-streamline-soc-2-compliance-insights-for-the-agile-enterprise/) (2024-04-23): Guide on using SBOMs to simplify SOC 2 Type I and Type II compliance through improved transparency, proactive risk management, and streamlined audits.
- [What really happened to XZ?](https://sbomify.com/2024/04/13/what-really-happened-to-xz/) (2024-04-13): Analysis of the XZ backdoor discovery in Linux distributions, exploring how this supply chain attack worked and the implications for open-source security.
- [Elevate Your Cybersecurity with Our Leading SBOM Management Solution](https://sbomify.com/2024/04/12/elevate-your-cybersecurity-with-our-leading-sbom-management-solution/) (2024-04-12): How sbomify's SBOM management platform helps organizations comply with Executive Order 14028 through comprehensive visibility, vulnerability management, and streamlined reporting.
- [NIST Cybersecurity Framework (CSF) 2.0: What It Means for Software Supply Chain Security](https://sbomify.com/2024/04/11/introducing-the-nist-cybersecurity-framework-csf-2-0/) (2024-04-11): A practical guide to NIST CSF 2.0, its six core functions including the new GOVERN function, and how SBOMs support CSF 2.0 implementation for supply chain risk management and vulnerability monitoring.
- [What Is a CBOM? The Cryptography Bill of Materials Explained](https://sbomify.com/2024/04/10/future-proofing-cybersecurity-with-the-cryptography-bill-of-materials-cbom/) (2024-04-10): What is a CBOM? The Cryptography Bill of Materials inventories every cryptographic asset in your software – algorithms, keys, certificates, and protocols. Learn how CBOMs prepare organizations for the post-quantum transition.
- [The Time is Now: Embracing SBOMs in an Era of Enhanced Cybersecurity Standards](https://sbomify.com/2024/04/03/the-time-is-now-embracing-sboms-in-an-era-of-enhanced-cybersecurity-standards/) (2024-04-03): Why 2024-2026 is the critical window for SBOM adoption. From EO 14028 and the EU Cyber Resilience Act to PCI DSS 4.0 and FDA guidance, regulatory requirements are converging – and the tooling is ready.
- [Demystifying SBOMs: The Backbone of Modern Software Security](https://sbomify.com/2024/04/03/demystifying-sboms-the-backbone-of-modern-software-security/) (2024-04-03): What is an SBOM? A Software Bill of Materials is a machine-readable inventory of every component in your software. Learn about SBOM formats (SPDX, CycloneDX), generation tools, vulnerability management, and compliance requirements.

---

From sbomify: https://sbomify.com/tags/security/