SBOMs Explained: What They Tell You and What They Don’t

About this video

A critical CVE drops. Is that component in your container image at all? An SBOM answers that in seconds. Whether it puts you at risk is a separate question, and this 2-minute explainer covers both.

In this video:

- What an SBOM records, and why SPDX and CycloneDX make it searchable

- Why a package being present doesn't make it exploitable

- Two common ways of generating SBOM

- Where provenance and signatures fit alongside the SBOM

Check out CleanStart's hardened, verified container images at https://images.cleanstart.com

• SBOM
• Provenance