Are you ready to master Software Bill of Materials (SBOM) and become the supply chain security expert your organisation needs in 2026?
Software supply chain attacks increased by 245% year-over-year. SolarWinds, Log4Shell, XZ Utils, and 3CX proved one brutal truth: you cannot defend what you cannot see. SBOM is the visibility layer that changes everything — and organisations that implement it respond to critical CVEs in seconds, not weeks.
—
What is SBOM and why does it matter right now?
A Software Bill of Materials (SBOM) is a machine-readable inventory of every component, library, and dependency inside a software product. Executive Order 14028 requires it for all software sold to the US federal government. The EU Cyber Resilience Act mandates it for all CE-marked products by December 2027. The FDA requires it in premarket submissions for medical devices. SBOM is no longer optional — it is a compliance requirement, a procurement expectation, and a security necessity.
Yet 86% of organisations find SBOM generation challenging, and most security teams still lack the skills to implement it correctly. This course closes that gap completely.
—
What You Will Learn
– Understand the full software supply chain threat landscape — SolarWinds, Log4Shell, XZ Utils, 3CX anatomy explained
– Generate SBOMs using Syft, Trivy, cdxgen, and CycloneDX build plugins
– Master SPDX (ISO/IEC 5962:2021), CycloneDX (ECMA-424), and SWID Tags
– Integrate SBOM generation into CI/CD pipelines — GitHub Actions, GitLab CI, Jenkins
– Deploy OWASP Dependency-Track for enterprise SBOM management and continuous CVE monitoring
– Implement VEX workflows to triage and communicate CVE exploitability status
– Enforce open-source license compliance with automated policy gates
– Meet EO 14028, NTIA, EU CRA, FDA, and NIST SSDF requirements
– Write SBOM contractual language for supplier procurement
– Sign SBOMs with cosign (Sigstore) for tamper-evident attestation
– Respond to zero-day CVEs and supply chain compromises using SBOM-powered scope determination
– Build a mature SBOM program from MVP to Level 4 — with 8 measurable KPIs
—
Hands-On Labs
– Generate your first SBOM in under 5 minutes with Syft
– CI/CD pipeline YAML for GitHub Actions and Dependency-Track
– Configure policy gates blocking critical CVEs and prohibited licenses
– Set up OWASP Dependency-Track with Docker Compose
– Apply the 10-point OSS intake checklist
– Use the 72-hour CVE response runbook
—
13 Modules covering: Threat Landscape · SBOM Fundamentals · SPDX vs CycloneDX · Syft & Trivy Tools · SDLC Integration · Vulnerability Management · License Governance · Regulatory Compliance · Procurement · SBOM Operations · Incident Response · Program Maturity · Certification Path
—
Regulatory Coverage: EO 14028 · NTIA Minimum Elements · OMB M-22-18 · FDA Cybersecurity · NIST SSDF · EU Cyber Resilience Act · EU NIS2
—
Enrol now and build the supply chain security visibility your organisation needs — before a CVE forces the question.
