SBOMs Fall Short in Revealing Supply Chain Attack Scope, Experts Warn
Relying solely on Software Bills of Materials (SBOMs) is insufficient for detecting and responding to sophisticated supply chain attacks, according to security professionals.
The effectiveness of Software Bills of Materials (SBOMs) in identifying the full scope of supply chain compromises is being called into question, with experts emphasizing the critical need for real-time visibility into production environments. A recent presentation at the ISC2 Security Congress 2026 highlighted how defenders struggled to ascertain the actual impact of a Shai-Hulud worm attack, underscoring the limitations of static dependency information.
During the session, Atlassian product security manager Deepam Kanjani detailed a real-world incident where a malicious transitive dependency, hidden several layers deep within a seemingly legitimate package, evaded initial security checks. Despite the package having a credible appearance and matching hash, its malicious payload was only flagged by a behavioral scanner. Crucially, the organization's SBOM reported the environment as clean, as it was outdated by two development sprints, illustrating a significant gap between documented dependencies and actual deployed code.
Incident responders faced considerable challenges in determining which services were affected by the compromise. While indicators of compromise (IOCs) provided initial clues, they could not definitively map the attack's reach. The lack of runtime telemetry forced the team into a laborious process of manually correlating logs across hundreds of services, hindering their ability to establish a reliable picture of the potential damage.
Efforts to attribute the attack to a specific threat actor also proved fruitless. Tracing registry ownership, npm maintainer history, and publisher identities led to dead ends, as the malicious repository was a copy of a legitimate project and attacker-provided information was fabricated. This highlights the sophisticated methods threat actors employ to obscure their tracks in supply chain attacks.
Kanjani stressed that organizations must shift their incident response strategies beyond static dependency lists and SBOMs. The focus should instead be on what is actually running in production, enabling security teams with the tools to identify, scope, prioritize, and contain incidents effectively. Real-time visibility into affected services and the potential scope of a compromise is paramount.
To address these challenges, Kanjani recommended maintaining deployed SBOMs under 72 hours old and ensuring that over 98% of production services meet this threshold. Furthermore, enabling runtime capabilities to detect unknown module loads within 90 seconds and conducting daily registry checks for package name lookalikes within 24 hours of publication are crucial proactive measures.
Ultimately, the incident serves as a stark reminder that while SBOMs are a valuable component of software supply chain security, they are not a panacea. Defenders need a multi-layered approach that combines static analysis with robust runtime monitoring and rapid incident response capabilities to effectively combat the evolving threat landscape of supply chain attacks.