No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild
Empirical analysis of 78K SBOMs reveals most lack dependency edges entirely, meaning vulnerability reachability and impact analysis built on them are unreliable—a critical gap as CRA mandates approach.
Summary written by editorial AI · Source link below
arXiv:2607.22140v3 Announce Type: replace-cross Abstract: Software Bills of Materials (SBOMs) are consumed not only as component inventories but as dependency graphs: vulnerability triage, reachability filtering, and impact analysis all traverse the edges an SBOM declares. We present the first large-scale characterization of the declared dependency graph across 78,612 real-world SBOM files from the Wild SBOMs dataset (77,092 parseable). We find that the population splits into three regimes: 52.
Editorial Analysis
Enterprises relying on SBOMs for CRA and NIS2 compliance may find their vulnerability triage fundamentally flawed if dependency graphs are absent, creating false confidence in software supply-chain security.
Audit SBOMs from your top 20 suppliers for dependency-edge completeness and flag any that are flat component lists only.
Most software bills of materials in circulation lack the dependency data needed for reliable vulnerability analysis, creating blind spots in supply-chain risk management ahead of CRA deadlines.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at arXiv Crypto & Security in a new tab.
More from the DevSecOps Desk
- A Protected Browser Doesn't Mean Your Enterprise Is Remediated3d
- Railway warns devs to rotate secrets after potential breach4d
- The Limits of Fingerprint Blocklists: A Reproducible Java Certificate Bypass5d
- eMudhra CA Incident: Sonatype's Assessment and Guidance5d
- Raise or Check? Predicting the Necessity of Additional Fuzzing for Continuous Fuzzing6d