Compliance
How SBOMs Can Help You Achieve PCI DSS 4.0 Compliance
What Is PCI DSS 4.0? The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards designed to ensure that...
Announcement
Introducing sbomify: Revolutionizing SBOM Management
We’re excited to announce the launch of sbomify, a platform designed to transform how businesses manage and share Software Bill of Materials...
News
Exploring the Future of Software Security: Join Us at BSides Bristol
This weekend marks an exciting event for the cybersecurity community – BSides Bristol is officially kicking off! We’re thrilled to be a part...
Announcement
Announcing sbomify's GitHub Actions Module: Seamlessly Share SBOMs in Your CI/CD Pipeline
We are thrilled to announce the launch of sbomify’s GitHub Actions Module – now available in the GitHub Marketplace! This powerful...
Education
Comparing SBOM Formats: Focus on Component Types in CycloneDX vs. SPDX
CycloneDX and SPDX are two leading SBOM (Software Bill of Materials) standards, each with distinct strengths and support for various...
Education
What Is SLSA? Understanding Supply Chain Levels for Software Artifacts
In 2020, attackers compromised SolarWinds’ build system and injected malicious code into Orion software updates that were distributed...
Education
What Is in-toto? Securing the Software Supply Chain End to End
When the XZ Utils backdoor was discovered in March 2024, it revealed how a malicious contributor could spend years infiltrating an...
Education
What Is Sigstore? Keyless Signing for the Software Supply Chain
Before Sigstore, signing a software artifact meant generating a GPG or PEM key pair, storing the private key securely, distributing the...
Guide
How to Generate SBOMs for Python Packages with `pipdeptree` and `cyclonedx-py`
Software Bill of Materials (SBOMs) are essential for ensuring transparency and security in software supply chains. This guide will show you...
Education
What Is Lock File Drift? A Hidden Risk in Dependency Management
A developer adds a new dependency to package.json, runs the application locally, confirms it works, and pushes the change. But they forget...
Compliance
Embracing Cybersecurity with CISA's 'Secure by Design' Initiative
In the ever-evolving landscape of cyber threats, the importance of integrating robust security measures into the earliest stages of software...
Education
Enhancing Dependency Management with GitHub's Dependency Graph: An Analysis
Introduction In the evolving landscape of software development, dependency management is a critical component. GitHub’s dependency graph is...