Loading story…
Organizations are moving beyond traditional vulnerability management and treating software transparency as a core security requirement, with Software Bills of Materials (SBOMs) becoming central to software supply chain defense. Reporting on preparations for the EU Cyber Resilience Act (CRA) says manufacturers of products with digital elements will be required to create, maintain, and when necessary provide inventories of software components, driving broader adoption of SBOM tooling and automation. The shift is intended to improve visibility into open-source libraries and third-party dependencies so teams can identify vulnerable packages, assess supplier risk, and respond faster to newly disclosed flaws.
Security practitioners are also pushing companies to use SBOMs as an operational tool rather than a compliance document. Group-IB researcher Anastasia Tikhonova said organizations should apply SBOM data continuously for vulnerability triage, vendor access reviews, identity monitoring, and incident response, as modern supply chain attacks increasingly link phishing, ransomware, and data breaches through inherited trust relationships. She warned that attackers’ use of AI is compressing attack timelines from weeks to minutes, increasing the need to prioritize exposed systems, define compromise windows, contain stolen credentials, and score vendor risk by access level and potential blast radius.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The referenced coverage says the EU Cyber Resilience Act will require manufacturers of products with digital elements to create, maintain, and when necessary provide inventories of software components. The article identifies this requirement as a driver of broader software transparency efforts.
In a Help Net Security video, Group-IB researcher Anastasia Tikhonova says organizations should use SBOMs continuously for vulnerability triage, vendor access reviews, identity monitoring, and incident response rather than only for compliance. She also describes practical response steps and warns that attackers' use of AI is compressing attack timelines.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new open-source Software Factory Security Framework (SF²), developed by Julie Davila of GitLab, has been introduced to help organizations strategically scale their security operations. The framework emphasizes resource allocation over simply increasing staff and outlines five core security responsibilities for software-producing organizations: supply chain security, process stewardship, runtime protection, third-party risk management, and continuous learning. SF² provides actionable guidance for each area, such as dependency monitoring and pipeline security controls, aiming to improve both security outcomes and business alignment. Simultaneously, the adoption of Software Bill of Materials (SBOMs) remains a contentious issue in the software industry. While SBOMs are recognized as essential for addressing supply chain security, their practical implementation is hampered by ecosystem complexity and incomplete coverage, especially in open-source projects. Companies like Docker have integrated SBOMs and provenance verification into their container images, but many organizations still struggle to generate comprehensive SBOMs for all software components. Recent updates from CISA have increased requirements for SBOM completeness, highlighting the ongoing challenges and ambivalence within the industry regarding their effectiveness.
Jun 29, 2026
CISA and partner agencies in the United States and 13 allied countries released updated guidance for the minimum elements of a Software Bill of Materials, replacing the 2021 NTIA baseline with broader requirements intended to improve software transparency and supply chain risk management. The revised framework preserves the original core principles but adds fields for component hash information, license data, author or digital signature, SBOM version, data format details, generation context, and tool metadata, while removing elements such as Access Control and SWID Tags. Officials said the changes were shaped by software supply chain security developments and feedback gathered during a 2025 public comment period. The update is designed to make SBOMs more useful for automated vulnerability management and procurement decisions, and it explicitly notes that some software categories need additional treatment beyond the general baseline. In parallel, the G7 Cybersecurity Working Group published guidance on the minimum elements for an AI-focused SBOM, providing actionable recommendations for public- and private-sector stakeholders to improve transparency across the AI supply chain. The combined guidance signals a broader international push to standardize software component disclosure for both conventional software and AI systems, with future work expected on SaaS, AI-specific components, SBOM trustworthiness, and links to formats such as **VEX** and **CSAF**.
Jul 31, 2026
Healthcare sector experts said **medical device cybersecurity** may become more manageable as manufacturers provide more complete **software bills of materials (SBOMs)** and hospitals improve asset visibility. Phil Englert of Health-ISAC said that when vulnerabilities such as **SweynTooth** emerge, organizations with better device component inventories can more quickly identify affected systems, and he pointed to U.S. FDA rules in effect since 2023 that require medical device makers to include SBOMs for commercial, open-source, and off-the-shelf components in premarket submissions for covered "cyber devices." Englert said higher-quality, more consistent SBOM data, combined with evolving **AI-enabled tools**, should help healthcare delivery organizations and manufacturers streamline vulnerability identification and resilience efforts across medical device environments. The reporting is based on the same HIMSS 2026 interview carried by two outlets, while separate commentary on **systemic third-party risk** in healthcare tied to the Change Healthcare ransomware incident addresses a different issue and does not describe the same specific development in medical device security.
Jun 29, 2026