You Can’t Secure What You Can’t See: SBOM, AIBOM & Software Supply Chain Risk
In this episode of the SecurityWeek Podcast, Brian Schleifer sits down with Allan Friedman for a deep dive into Software Bills of Materials (SBOM), AI Bills of Materials (AIBOM), software supply chain security, VEX, and the growing challenge of understanding exactly what is inside the technology organizations depend on.Friedman explains SBOM in practical terms: modern software isn’t simply written—it is assembled from other software, libraries, dependencies, and components. That makes visibility into those components critical when vulnerabilities such as Log4j, supply chain compromises, malicious updates, and other security incidents emerge.But generating an SBOM is only the beginning.The conversation explores how organizations can move from simply collecting SBOMs to integrating them into vulnerability management, asset management, procurement, incident response, third-party risk management, and continuous risk monitoring.The discussion then turns to artificial intelligence and AIBOM. AI systems introduce additional layers beyond traditional software, including models, training and supporting data, external data sources, RAG architectures, agentic systems, runtime dependencies, and increasingly dynamic components. As AI systems become more autonomous, determining what needs to be captured—and how continuously it must be monitored—is becoming a major cybersecurity challenge.Brian and Allan also discuss VEX (Vulnerability Exploitability eXchange), why the presence of a vulnerable component does not automatically mean a system is exploitable, and how machine-readable vulnerability information can help security teams prioritize actual risk.Finally, Allan looks toward the future of software transparency, including cryptographic bills of materials, hardware bills of materials, AI bills of materials, updated international SBOM guidance, and the possibility that these different transparency artifacts eventually converge into what he calls an “OmniBOM.”In this episode:• What an SBOM actually is—and what it is not• Why software transparency matters to defenders• How SBOM can improve vulnerability and incident response• Why organizations should integrate SBOM data into existing security tooling• The relationship between SBOM and third-party risk management• Why vulnerable components are not always exploitable• How VEX helps organizations determine what vulnerabilities actually matter• What an AIBOM needs to capture beyond traditional software• Models, data, RAG, agents, runtime dependencies, and AI transparency• Why dynamic and agentic AI systems complicate traditional BOM approaches• Continuous monitoring and continuous risk management• CISA and international SBOM guidance• Cryptographic Bills of Materials and post-quantum readiness• Hardware Bills of Materials• The future of the “OmniBOM”• Why defenders need greater visibility into the systems they are responsible for securingAllan Friedman has spent years helping shape the evolution and adoption of SBOM across government, industry, open source, and the broader cybersecurity community. In this conversation, he explains not only where SBOM came from, but where software transparency is heading as AI fundamentally changes how applications are built and operated.If you work in cybersecurity, application security, software development, vulnerability management, third-party risk, AI security, software supply chain security, critical infrastructure, or technology policy, this is a conversation worth listening to. (Watch on YouTube)#Cybersecurity #SBOM #AIBOM #SoftwareSupplyChain #AISecurity #SoftwareSecurity #VulnerabilityManagement #VEX #SupplyChainSecurity #SecurityWeekFollow SecurityWeek on LinkedIn
