Loading…
← Back to schedule
SBOMs Are Useless Without Discoverability - Mario Fahlandt & Koray Oksay, Kubermatic
Tuesday October 6, 2026 17:20 - 17:35 CEST
South Hall 3B
SBOM generation is a solved problem. Syft, Trivy, and many more tools spit them out by the thousands. But what happens next? In most enterprises: nothing. SBOMs land in a bucket or CI artifact, and nobody looks at them again. The real challenge isn't producing SBOMs; it's making them actionable at scale.

This talk introduces BOMHort, an open source Kubernetes-native platform for SBOM consumption, visualization, and governance. We focus on the problem every enterprise faces once compliance mandates SBOM production: how do you make thousands of SBOMs searchable, surface relevant vulnerabilities and license issues, and produce reports that security, legal, and engineering teams can all understand without being SPDX experts?

BOMHort ingests SPDX and CycloneDX SBOMs from S3-compatible storage, enriches them with OSV vulnerability data, enforces configurable license compliance policies, and applies VEX statements for false positive suppression. All of it runs through a dashboard that turns raw SBOM data into decisions. We share lessons from building BOMHort and from enterprises that learned the hard way: an SBOM nobody can read is just compliance theater.
Speakers
avatar for Mario Fahlandt

Mario Fahlandt

Customer Delivery Architect, Kubermatic
Mario Fahlandt is a CNCF Technical Oversight Committee member, SIG ContribEx co-chair, and Kubernetes AI Conformance subproject lead. He maintains cncf/sbom, the project generating SPDX SBOMs for every CNCF release, and created SeeBOM, an open-source SBOM governance platform now applying... Read More →
avatar for Koray Oksay

Koray Oksay

Consultant, Kubermatic
Koray works at Kubermatic as a Kubernetes Consultant and Trainer, helping companies on their cloud-native journey. Before that, Koray worked for startup and enterprise companies in the advertising, banking, and telecom industries as a SysAdmin, Application Admin, DevOps Engineer... Read More →
Tuesday October 6, 2026 17:20 - 17:35 CEST
South Hall 3B
  Securing the Software Supply Chain

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Tweet Share

Get help with the event

Contact event planner Event login
View support guides Find upcoming events
Create an event you'd love to attend!
Explore why organizers choose Sched • Success stories
Event App • Event scheduling • Event registration • Event ticketing • Sched forms • Call for papers • Badges • Conferences
© 2026. SCHED LLC - All rights reserved - Helping events since 2008
Conference Scheduling Software • Privacy • Terms
Share Modal

Share this link via

Or copy link