SBOMs Are Not Enough | Brian Demers (EN)

Video Description

Software Bill of Materials (SBOMs) have emerged as a critical component of software supply chain security, promising transparency about the dependencies in our applications. But are they delivering on that promise? While SBOMs provide a snapshot of the components included in software, they often fail to address a vital piece of the puzzle: the tools, libraries, and configurations actually used to build it. In this talk, we’ll explore the varying degrees of SBOM quality and expose the gaps that can undermine their utility. By understanding what SBOMs are—and what they aren’t—we’ll uncover the risks of relying on incomplete or inaccurate data and discuss complementary strategies for achieving a truly transparent and secure build process. Attendees will leave with a deeper appreciation of how SBOMs fit into the broader supply chain security landscape and actionable insights for bridging the gaps. Who should attend: Developers, security professionals, and DevOps practitioners looking to enhance software supply chain security beyond the baseline provided by SBOMs. ➜ Subscribe to JAVAPRO and never miss an update: https://bit.ly/YouTube-JAVAPRO-subscribe ▬ About us: ▬ JAVAPRO is the magazine for professional, real-world Java development. Beyond the publication, JAVAPRO organises the annual developer conference JCON, which focuses on Core Java, Enterprise Java, Microservices, AI, APIs, and frameworks. On this channel, you'll find interviews, sessions, tips & tricks, and everything a Java developer could ask for. ➜ Read JAVAPRO online or download the PDF: https://javapro.io ➜ Join the next live training session: https://javapro.io/training/ ▬ Follow us on social media: ▬ Twitter: https://x.com/JAVAPROmagazin LinkedIn: https://www.linkedin.com/company/75505519 ➜ Thanks for watching – subscribe for more Java!