Allan Friedman on SBOMs, AI BOMs and the Future of Software Transparency

Summary

Allan Friedman explains how SBOMs and VEX can support vulnerability response, why AI systems may need broader inventories, and how organizations can integrate software transparency into ongoing security and risk processes.

Key points

• Friedman says accurate SBOMs help suppliers and customers identify exposure more quickly during widespread software supply-chain events.
• He recommends integrating SBOM data with vulnerability management, asset management, procurement and continuous risk management.
• VEX can clarify whether a vulnerable component affects a product, helping teams prioritize beyond simply finding a component version.
• AI inventories may need to document models, supporting data, external runtime data and the infrastructure used to operate AI systems.
• For dynamic AI agents, Friedman points to logging and supporting evidence as ways to reconstruct activity and enable forensic analysis.
• Friedman argues that software transparency gives defenders useful visibility; SBOM standards can also support redaction of sensitive dependency details.
• He notes that SBOM tools may produce different dependency graphs for the same software, making interoperability and common expectations ongoing challenges.

People

Industries