SBOMs – The Missing Link
summary
Schneider Electric collects and catalogs thousands of SBOMs (about 4,000 SBOMs covering roughly 400–500 product SKUs), enforces a policy that a release must provide an SBOM, and ingests SBOMs from binary SCA and third-party suppliers. Tools run multiple scanners, reconcile divergent results with dev teams, and flag hits for impact assessments used during Log4j and OpenSSL events. Quality varies — binary-scan detection ranges 15–90% — but the process measurably cuts triage days and staff hours.
AI-written summary · about
chapters (13)
- 0:00Introduction and logistics
- 1:04Speaker background
- 1:46Supply chain at Schneider
- 4:21Supply chain security
- 5:22Understanding SBOMs
- 10:15Starting the SBOM journey
- 13:00Leveraging SBOMs at scale
- 16:07Vulnerability management
- 16:54Impact assessments
- 19:52Technical implementation
- 31:03Summary and Q&A
- 36:35Sharing SBOMs with customers
- 40:12Hardware and lifecycle
related talks
26mSBOM today: What is the state of SBOMs?
47mThe Missing Link - How we collect and leverage SBOMs
27mSBOM: The Rest Of the Story
34mSBOM Quality: We Need More Than a Simple “SBOM Button” for Compliance
23mSBOM adopatability in open source software scanning
20mSBOMs in the Real World: Practical Guidance for Managing Three Common SBOM Sce...
46mSBOMs Are Not Enough
52mThe World on SBOMs