Cloud / DevSecOpsEnterprise software / developer tooling6-week program build
An SBOM program that turned 'are we affected?' into a minutes-long question
Growth-stage devtools vendor, ~200 staff, shipping self-hosted and cloud editions
When a critical dependency vulnerability landed, this vendor's last response took three engineers most of a week grepping build files — while enterprise customers demanded answers they didn't have. We built the dependency inventory they thought they already had, wired SBOM generation into CI for every release, and hardened the build pipeline the SBOMs describe. The next advisory was answered from a query, not an archaeology dig.
Representative engagement — the client is confidential, and the figures and the quoted comment illustrate typical outcomes for the work described.
- Advisory impact triage
- ~1 week → same morning
- queried against versioned SBOMs
- Dependencies invisible to previous tooling
- hundreds
- vendored code and container base layers reconciled
- Releases shipping signed SBOMs
- 100%
- generated in CI since rollout
- Customer SBOM requests
- self-serve
- handled by sales without engineering escalation
The challenge
- No authoritative inventory: dependency knowledge lived in scanner dashboards that missed vendored code and container base layers.
- Enterprise and public-sector customers had started requiring SBOMs contractually, with the EU Cyber Resilience Act on the horizon.
- The build pipeline had grown organically, with unsigned artifacts and no provenance trail.
What we did
- Built the full inventory — direct, transitive, vendored and base-layer — and reconciled it against what the scanners believed.
- Stood up CycloneDX SBOM generation in CI so every release ships with an accurate, versioned bill of materials.
- Analysed the inventory for risk beyond CVEs: abandoned packages, single-maintainer dependencies and typosquat-adjacent names.
- Reviewed the pipeline against SLSA and sequenced pragmatic hardening: artifact signing and provenance first, not a maturity-theatre leap to the top level.
- Documented the customer-facing SBOM delivery process so sales could answer procurement requirements without engineering escalation.
The outcome
- Dependency-advisory response became a query against versioned SBOMs — the next critical advisory was triaged the same morning it published.
- Every release now ships signed artifacts with provenance and a machine-readable SBOM, satisfying contractual requirements already in force.
- The gap between what scanners reported and what actually ships was measured, closed and is now continuously tracked in CI.
“Last time it was three engineers and a week of grepping. This time it was one query and we'd answered every customer by lunch. That's the whole argument for SBOMs in one sentence.”