Name: When SBOMs Differ: A Large-Scale Empirical Study of Generation, Dependency Structure, and Regulatory Alignment - Lukas Gehrke, Technical University of Munich
Start: 2026-10-06T16:42:00+0200
End: 2026-10-06T17:00:00+0200

When SBOMs Differ: A Large-Scale Empirical Study of Generation, Dependency Structure, and Regulatory Alignment - Lukas Gehrke, Technical University of Munich

Tuesday October 6, 2026 16:42 - 17:00 CEST

South Hall 3A

Modern software relies on a multitude of dependencies, meaning a single compromised library can jeopardize all downstream software. Attackers increasingly exploit this structural weakness, leading to a proliferation of supply chain attacks with severe consequences across the broader software landscape. Recent legislation proposes using SBOMs to address this threat. However, researchers have identified many practical challenges in realizing the security benefits of SBOMs. These challenges underscore the need for a better understanding of the SBOM ecosystem. We address this need with the following four contributions. First, we present and publish a large-scale dataset of real-world SBOMs, comprising 468550 unique SBOMs from 93445 open-source repositories. These SBOMs were either obtained from the GitHub Dependency Graph or self-generated with Syft and Trivy, two well-established open-source SBOM generators. Second, we analyzed the agreement on the dependency sets between these SBOM generators and identified discrepancies. Third, we shed light on how these generators embed dependency structure in their SBOMs. These structures differ significantly, with strong implications for SBOM use cases. Fourth, we evaluated SBOM characteristics against current regulatory guidelines using sbomqs, a widely accepted tool for ascertaining SBOM quality and compliance. For SBOMs generated by different tools, sbomqs indicated varying adherence to these guidelines. Overall, our work provides an open, extensible empirical analysis of the SBOM ecosystem, serving as a knowledge base for establishing best practices for SBOMs to unlock their real-world security benefits.

Speakers

Lukas Gehrke

Doctoral Candidate, Technical University of Munich

Lukas Gehrke is a doctoral candidate at Technical University of Munich. His research focuses on software supply chain security and how software bills of materials (SBOMs) can help achieve it.

Tuesday October 6, 2026 16:42 - 17:00 CEST
South Hall 3A

SCORED Sessions, SBOM and Beyond

about <br>

OpenSSF Community Day Europe 2026

Lukas Gehrke

Get help with the event

OpenSSF Community Day Europe 2026

Lukas Gehrke

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Get help with the event