Loading story…
CISA and partner agencies in the United States and 13 allied countries released updated guidance for the minimum elements of a Software Bill of Materials, replacing the 2021 NTIA baseline with broader requirements intended to improve software transparency and supply chain risk management. The revised framework preserves the original core principles but adds fields for component hash information, license data, author or digital signature, SBOM version, data format details, generation context, and tool metadata, while removing elements such as Access Control and SWID Tags. Officials said the changes were shaped by software supply chain security developments and feedback gathered during a 2025 public comment period.
The update is designed to make SBOMs more useful for automated vulnerability management and procurement decisions, and it explicitly notes that some software categories need additional treatment beyond the general baseline. In parallel, the G7 Cybersecurity Working Group published guidance on the minimum elements for an AI-focused SBOM, providing actionable recommendations for public- and private-sector stakeholders to improve transparency across the AI supply chain. The combined guidance signals a broader international push to standardize software component disclosure for both conventional software and AI systems, with future work expected on SaaS, AI-specific components, SBOM trustworthiness, and links to formats such as VEX and CSAF.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
A day after the updated SBOM guidance, CISA issued separate guidance on open source software security for government agencies. The guidance encouraged a default-open-source approach for government-developed software and called for transparency into AI-related components, including model training data.
Government agencies in the United States and 13 allied countries released updated guidance on SBOM minimum elements, replacing the 2021 baseline and adding fields such as component hashes, license data, generation context, tool metadata, and SBOM version.
A paper produced by the G7 Cybersecurity Working Group set out actionable guidance on the minimum elements an AI SBOM should contain for public and private sector stakeholders.
The G7 introduced a shared vision for AI software bills of materials, providing the basis for later guidance on minimum AI SBOM elements.
Feedback gathered during a 2025 public comment period was incorporated into the revised SBOM minimum elements guidance.
The 2026 SBOM guidance replaces the 2021 NTIA SBOM Minimum Elements guidance, which established the original baseline framework for software bill of materials content.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourcehelpnetsecurity.com
Open sourcesecurityweek.com
Open sourcecisa.gov
Open sourcebsi.bund.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Organizations are moving beyond traditional vulnerability management and treating software transparency as a core security requirement, with **Software Bills of Materials (SBOMs)** becoming central to software supply chain defense. Reporting on preparations for the EU **Cyber Resilience Act (CRA)** says manufacturers of products with digital elements will be required to create, maintain, and when necessary provide inventories of software components, driving broader adoption of SBOM tooling and automation. The shift is intended to improve visibility into open-source libraries and third-party dependencies so teams can identify vulnerable packages, assess supplier risk, and respond faster to newly disclosed flaws. Security practitioners are also pushing companies to use SBOMs as an operational tool rather than a compliance document. Group-IB researcher Anastasia Tikhonova said organizations should apply SBOM data continuously for vulnerability triage, vendor access reviews, identity monitoring, and incident response, as modern supply chain attacks increasingly link phishing, ransomware, and data breaches through inherited trust relationships. She warned that attackers’ use of AI is compressing attack timelines from weeks to minutes, increasing the need to prioritize exposed systems, define compromise windows, contain stolen credentials, and score vendor risk by access level and potential blast radius.
Jul 10, 2026
A new open-source Software Factory Security Framework (SF²), developed by Julie Davila of GitLab, has been introduced to help organizations strategically scale their security operations. The framework emphasizes resource allocation over simply increasing staff and outlines five core security responsibilities for software-producing organizations: supply chain security, process stewardship, runtime protection, third-party risk management, and continuous learning. SF² provides actionable guidance for each area, such as dependency monitoring and pipeline security controls, aiming to improve both security outcomes and business alignment. Simultaneously, the adoption of Software Bill of Materials (SBOMs) remains a contentious issue in the software industry. While SBOMs are recognized as essential for addressing supply chain security, their practical implementation is hampered by ecosystem complexity and incomplete coverage, especially in open-source projects. Companies like Docker have integrated SBOMs and provenance verification into their container images, but many organizations still struggle to generate comprehensive SBOMs for all software components. Recent updates from CISA have increased requirements for SBOM completeness, highlighting the ongoing challenges and ambivalence within the industry regarding their effectiveness.
Jun 29, 2026
Government and industry leaders are intensifying efforts to address software supply chain security, with a particular focus on the adoption of Software Bills of Materials (SBOMs) and the potential for holding software vendors liable for security failures. In the United States, the push for SBOMs has been driven by federal policy, but private sector adoption remains slow, even as the rapid evolution of AI-assisted coding introduces new complexities and risks. Experts are divided on whether AI will reduce or exacerbate vulnerabilities, but there is consensus that transparency in software components remains critical for managing security risks. In the United Kingdom, lawmakers are calling for significant regulatory changes, including introducing liability for software developers, incentivizing cyber resilience investments, and mandating incident reporting. These recommendations come in response to a series of high-profile cyber incidents, such as the attack on Jaguar Land Rover, which have underscored the economic and public risks posed by insecure software. The debate continues between industry groups, who warn that liability could stifle innovation, and security leaders, who argue that the current system leaves critical infrastructure and the broader economy exposed to escalating cyber threats.
Jul 12, 2026