Training Example: Anchore, Inc. – Review the Data, Give Your Score & Compare to the Real AI Evaluation

Webinar: Eliminating the "Security Tax" with Anchore Enterprise v6 >>
[H1] Control your supply chain risk. Stay compliant by default.
Achieve compliance faster with SBOM management, vulnerability detection, and advanced policy enforcement. REQUEST A DEMO > EXPLORE ANCHORE ENTERPRISE > Trusted by Enterprises Trusted by Government AUTOMATE COMPLIANCE
[H3] Ease the path to regulatory compliance
Establish DORA, CRA, NIS2 compliance with automated SBOM and vulnerability workflows. Use pre-built policy packs to automate checks for NIST, FedRamp, DISA, and more. Access reports that validate proof of compliance for individual controls. Explore Solution COMPLETE VISIBILITY
[H3] Understand your software supply chain with Software Bill of Material (SBOM) management
Automatically generate accurate SBOMs Import SBOMs in SPDX, CycloneDX, and Syft native formats Organize SBOMs in an application/version structure Monitor SBOM changes throughout the SDLC Track and manage open source and third party risk Explore Solution EARLIER & FASTER REMEDIATION
[H3] Automate DevSecOps: Shift left security early into the DevOps pipeline
Comprehensive security scans for container images, filesystems, and source repositories, combining vulnerability scanning with secret and malware detection. Mitigate active exploits or investigate historical risks with continuous scans. Proactively manage the next zero-day with a quick search of the SBOM repository. Explore Solution
[H3] Client Success Stories
“Anchore has proven to be a valuable tool, helping to ensure that the Cisco Container Platform matches our compliance standards”
[IMG: client logo]
- Corporate Security Team
[IMG: decorative quote marks]
[H3] Client Success Stories
“Teaming with Anchore to shape the container hardening process for Platform One has been highly successful. Anchore’s strong understanding of our goals has translated into strong support for adoption of modern DevSecOps practices.”
[IMG: client logo]
Lt. Col. Brian Viola, Material Leader - Platform One
[IMG: decorative quote marks]
[H3] Client Success Stories
“Our use of Anchore’s scanning technology can help reassure developers that the containers on NGC have been evaluated for critical security risks before they’ve been put into production.”
[IMG: client logo]
[IMG: decorative quote marks]
[H3] Client Success Stories
“Anchore is one of few container security companies that are approved as part of the DoD Enterprise DevSecOps initiative and a key component for ensuring the security and compliance of software containers within the DoD Iron Bank”
[IMG: client logo]
[IMG: decorative quote marks]
Blog | May 21, 2025
[H3] Take Control of Your Software Supply Chain: Introducing Anchore SBOM
Today, we’re launching Anchore SBOM. Anchore Enterprise now allows you to m... Read the Blog
[H2] Additional Resources
[IMG: Anchore Software Supply Chain Security Graphic]
[H4] SCA vs. SBOM: How They Differ & Why They Work Best as a Team
Read the Article
[IMG: FedRAMP Vulnerability Scanning solution illustration]
[H4] Cybersecurity Compliance: What You Need to Know
Read the Article
[IMG: SBOM illustration showing numerous software dependencies transformed into a single SBOM document]
[H4] Software Bill of Materials Overview
Read the Article
[H3] Speak with our security experts
Learn how Anchore’s SBOM-powered platform can help secure your software supply chain. Contact Us

[H1] Anchore Open Source Tools.
Developer-friendly scanning tools for container image security. A CLI tool for generating a Software Bill of Materials (SBOM) from container images and filesystems. Try Syft Watch in action An easy-to-integrate open source vulnerability scanning tool for container images and filesystems. Try Grype Watch in action A CLI tool and Go library for checking licenses in container images, SBOMs, and filesystems. Try Grant
[IMG: Play Video]
[H3] Join our live stream every Thursday.
Join the Anchore Open Source team to discuss issues, pull requests, and future roadmap planning in our SBOM and vulnerability tools. Watch the live stream! Generate a comprehensive Software Bill of Materials (SBOM) with our CLI tool, Syft. Gain visibility down to the file level. Automatically generate SBOMs in your CI/CD pipeline. Uncover direct and transitive dependencies. Output SBOMs in JSON, SPDX, and CycloneDX formats. Download on GitHub Learn More Generate a list of known vulnerabilities from an SBOM, container image, or project directory with our CLI tool, Grype. Scan OS and language-specific packages. View optimized results across vulnerability sources. Automate scans in your CI/CD pipeline. Combine with Syft for faster scans. Download on GitHub Star on GitHub Tutorials and documentation for easy implementation. Syft Getting started Documentation Grype Getting started Documentation Tutorials and documentation for easy implementation. Visually hidden Mar 06, 2025
[H4] Making Virtual Machine Security Analysis Easier with sbom-vm
Read the Blog Visually hidden Feb 25, 2025
[H4] Syft 1.20: Faster Scans, Smarter License Detection, and Enhanced Bitnami Support
Read the Blog Visually hidden
[IMG: Generating Python SBOMs: Using pipdeptree and Syft]
Mar 03, 2025
[H4] Generating Python SBOMs: Using pipdeptree and Syft
Read the Blog Visually hidden
[IMG: Syft Debugging Cataloger Output]
Feb 13, 2025
[H4] How Syft Scans Software to Generate SBOMs
Read the Blog Visually hidden
[IMG: SBOM Lifecycle Graphic]
Feb 06, 2025
[H4] SBOMs 101: A Free, Open Source eBook for the DevSecOps Community
Read the Blog Visually hidden Dec 20, 2024
[H4] Going All In: Anchore at SBOM Plugfest 2024
Read the Blog
[H2] Open source foundation, enterprise-ready.
Anchore Enterprise builds on open source Syft and Grype to deliver a continuous compliance and security solution built for the needs of enterprises and government agencies. Secure development pipelines across multiple teams and toolchains. Provide security teams with the visibility and policy controls they need to ensure compliance. Explore our Platform
[H3] GitHub
Get the source code and contribute to the project. Download Open Source
[H3] Discourse
Join our Discourse forum and chat with community members. Join Discourse
[H3] Twitter
Follow us on Twitter to stay current with the latest Anchore developments. Follow Anchore
[H3] Demo
See how Anchore can help secure your software supply chain. Request a Demo

Home / Software Supply Chain Security Tool
[H1] Software Supply Chain Security Tools for Modern DevSecOps
Armed with a complete view of your organization’s software assets, Anchore Enterprise allows you to find and prevent malicious content from reaching your users.  Request a Demo Get the whitepaper How Anchore Secures the Software Supply Chain End to End SBOM Coverage Enforce Provenance Controls Prevent Content Drift
[H2] Prevent software supply chain attacks with Anchore
Anchore’s end-to-end, SBOM-powered software supply chain security management platform protects you and your customers at every step, from SBOM monitoring to policy enforcement to remediation. Anchore integrates at every stage of the software development process from source code to build to runtime. Every package, every library, every version is cataloged and stored.  This enables organizations to find out where content is, where it came from, and how it changed. Anchore’s policy engine ensures you can automate checks to detect and prevent malicious content at every step in your pipeline and ensure only the most trusted content is released to downstream users. With its flexible APIs, Anchore integrates with your existing platforms and tools to ensure that it starts delivering value without major changes to how you build and run software.
[H3] End-to-end SBOM coverage
Anchore automatically generates and analyzes comprehensive software bills of materials (SBOMs) at each step of the software development lifecycle (SDLC) to help teams identify vulnerable or malicious code before it reaches production. SBOMs are stored in a repository to provide visibility into components, dependencies, and continuous vulnerability monitoring. Learn more about Anchore SBOM Management >
[H3] Enforce provenance controls
Flexible policy rules ensure only approved content is allowed into your software pipeline. Create strict rules for production that only allow use of internal builds but allow developers to experiment with new open source libraries.  Use Anchore Enterprise to better understand which vendors you are using in your applications.
[H3] Prevent content drift
Detect SBOM drift in the build process to uncover unexpected dependencies, malicious efforts to infiltrate builds, and inadvertent errors. Alert security staff to changes in SBOMs so they can be assessed for risks or malicious activity. See a tutorial of Anchore Enterprise here.  Start Free Trial
[H2] How Anchore helps secure your software supply chain
[H2] Software Supply Chain Security Solutions for the Public & Private Sector
[H3] Enterprises
Respond to the next Log4Shell in minutes rather than days. Enforce usage policies within developer workflows to ensure they are only using trusted components and avoid the reputation and financial costs of being the next high profile supply chain attack victim.
[H3] Software Vendors
Establish customers’ trust in your product by demonstrating best practices in software supply chain security. Provide transparency into open source dependencies, container images, and their provenance.
[H3] Public Sector
Comply with the Secure Software Development Framework by generating and storing SBOMs across software you develop, buy, or use. Understand your dependency on open source software and its associated risks.
[H2] Software Supply Chain Security FAQs
Have another question? Contact Us Software supply chain security is the practice of identifying and preventing vulnerabilities in third-party components from compromising the applications that rely on them. Dive deeper into the topic in our overview of software supply chain security. The technical and operational complexity of a software supply chain takes security risks to a new level. The historically open, collaborative nature of software development has helped improve development efficiency. Unfortunately, this has led to one of the most pervasive operating principles: assume your suppliers are doing the right thing.  The software supply chain security model makes it challenging to “trust but verify” so as a supply chain owner it’s even more important to ask for more information about the software while improving collaboration and communications up and down the software supply chain. Two of the most important aspects to consider when securing your software supply chain are securing software workloads and securing development toolchains. The SolarWinds and HAFNIUM breaches show we’re entering a new era of cyber attacks. While industry and government cybersecurity teams face new onslaughts of attacks every day, a software supply chain attack takes emerging threats to the next level. Conventional cybersecurity strategies can’t counter an attack against an organization’s software supply chain. More recently, the extensive use of Log4j and the severity of the exploit means security professionals and development teams are going to take a more proactive stance to resolution. What the industry has learned from these attacks is that it’s imperative to get immediate visibility into your software supply chain risk using open source tools or paid platform like Anchore Enterprise. One thing is for sure, as we get ready for the long haul, teams must prepare for the next inevitable critical issue that surfaces.
[H2] Learn more About Securing the Software Supply Chain
[IMG: Anchore Software Supply Chain Security Graphic]
Article
[H4] What is Software Supply Chain Security?
Read the Article Report
[H4] 2024 Trends in Software Supply Chain Security
Access the Report Article
[H4] 6 Best Practices for Securing the Software Supply Chain
Read the Article
[H3] Explore our Solutions
[H3] Federal Compliance
Automate compliance checks using out-of-the-box and custom policies. Learn more
[H3] Open Source Security
Improve open source security by easily tracking direct and transitive open source dependencies to identify and fix vulnerabilities early. Learn more
[H3] DevSecOps
Automate DevSecOps for your cloud-native software supply chain with an API-first DevSecOps solution. Learn more
[H3] Container Security Solution
Identify and remediate container security risks and monitor post-deployment for new vulnerabilities. Learn more
[H3] FedRAMP Vulnerability Scanning
Meet the new FedRAMP Vulnerability Scanning Requirements for Containers and achieve compliance faster with Anchore. Learn more
[H3] Container Vulnerability Scanning
Reduce false positives and false negatives with best-in-class signal-to-noise ratio. Learn more
[H3] Kubernetes Images Scanning
Allow or prevent deployment of images based on flexible policies and continuously monitor the inventory of insecure images running in your clusters. Learn more
[H3] Container Registry Scanning
Identify and remediate new risks and vulnerabilities as they emerge. Learn more
[H3] CI/CD Security & Compliance
Embed security and compliance into your CI/CD pipeline to uncover vulnerabilities, secrets, and malware in your automated build processes. Learn more
[H3] SBOM Management
Get comprehensive visibility of your software components and ensure vulnerability accuracy with the most complete SBOM available. Generate, store, analyze, and monitor SBOMs across the application lifecycle to identify software dependencies and improve supply chain security. Learn more
[H3] Container Compliance
Automate compliance checks using out-of-the-box and custom policies. Learn more
[H3] NIST
Learn more
[H3] Software Supply Chain Security Tool
Learn more
[H2] Speak with our security experts
Learn how Anchore’s SBOM-powered platform can help secure your software supply chain. Contact Us

Home / SBOM / Software Bill of Materials Overview
[H1] Software Bill of Materials (SBOMs)
Updated on October 20, 2025 See the Solution Download the Guide
[IMG: SBOM illustration showing numerous software dependencies transformed into a single SBOM document]
Navigate To Close Table of Contents Table of Contents
[H2] Fast Facts
A software bill of materials (SBOM) is a structured list of software components, modules, and libraries that are included in an application. SBOMs help identify security vulnerabilities and risks in software, provide visibility for DevSecOps, and help streamline compliance with cybersecurity standards like NIST and EU CRA. The two most common SBOM formats are SPDX and CycloneDX. Tools like Anchore SBOM help organizations generate, manage, and analyze SBOMs at scale. In the dynamic landscape of software development, the past decade has witnessed two transformative shifts that have redefined the industry’s trajectory. The first is the widespread adoption of open-source software components, providing developers with a vast repository of pre-built modules to streamline their work. The second is the embrace of DevOps principles, automating and accelerating the software build and delivery process. Together, these shifts promised unprecedented efficiency and speed. However, they also introduced a labyrinth of complexity, with software compositions becoming increasingly intricate and opaque. This complexity, coupled with the relentless pace of modern development cycles, created a pressing need for a solution that could offer clarity amidst the chaos. This is the backdrop against which the Software Bill of Materials (SBOM) emerged. This guide delves into the who, what, why, and how of SBOMs. Whether you’re a developer, a security professional, or simply someone keen on understanding the backbone of modern software security, this guide offers insights that will equip you with the knowledge to navigate all of the gory details of SBOMs. Explore SBOM use-cases for almost any department of the enterprise and learn how to unlock enterprise value to make the most of your software supply chain. Download Now
[IMG: WHITE PAPER Rnd Rect | Unlock Enterprise Value with SBOMs: Use-Cases for the Entire Organization]
[H2] What is a Software Bill of Materials (SBOM)?
A software bill of materials (SBOM) is a structured list of software components, modules, and libraries that are included in an application. Similar to the nutrition labels on the back of the foods that you buy, SBOMs are a list of ingredients that the software is composed of. We normally think of SBOMs as an artifact of the software development process. As a developer is building an application using different open-source components, they are also creating a list of ingredients; an SBOM is the digital artifact of this list.To fully extend the metaphor, creating a modern software application is analogous to crafting a gourmet dish. When you savor a dish at a restaurant, what you experience is the final, delicious result. Behind that dish, however, is a complex blend of ingredients sourced from various producers, each contributing to the dish’s unique flavor profile. Just as a dish might have tomatoes from Italy, spices from India, olive oil from Spain, and fresh herbs from a local garden, a software application is concocted from individual software components (i.e., software dependencies). These components, like ingredients in a dish, are meticulously combined to create the final product. Similarly, while you interact with a seamless software interface, behind the scenes, it’s an intricate assembly of diverse open source software components working in harmony.
[H2] Benefits of SBOMs
SBOMs are one of the most powerful security tools that you can use. Large-scale software supply chain attacks that affected SolarWinds, Codecov, and Log4j highlight the need for organizations to understand the software components—and the associated risk—of the software they create or use. The following are a few advantages of using SBOMs within your organization: Identify security vulnerabilities and risks in software: SBOMs provide a detailed inventory of all components in a software application, including third-party components and open-source dependencies, enabling organizations to identify vulnerabilities quickly. This helps expose and mitigate critical security risks in the software supply chain and supports faster incident response. Comply with standards: Regulations such as the U.S. Executive Order on Improving the Nation’s Cybersecurity require SBOMs for secure software delivery. Cybersecurity frameworks such as NIST 800-53 and FedRAMP also encourage the use of SBOMs. Visibility and support for DevSecOps: Ultimately, SBOMs are a source of truth. They integrate seamlessly with CI/CD pipelines to automate vulnerability scanning and compliance checks and support collaboration by acting as a shared source of truth across development, operations, and security teams. Analyze trends: Beyond identifying security risks, SBOMs enable you to spot trends in how software changes over time, potentially introducing new risks or threats. Cost savings: SBOMs support cost savings in a variety of ways. They enable faster identification of vulnerabilities to strengthen risk managment and reduce the cost of prolonged system downtime. They reduce development time and cost by exposing and remediating issues earlier in the cycle. And they provide visibility into components to prevent unintentional use of unsupported or outdated software. Knowing what’s in software is the first step to securing it. Increasingly, organizations are developing and using cloud-native software that runs in containers. Consider the complexity of these containerized applications that have hundreds—sometimes thousands—of components from commercial vendors, partners, custom-built software, and open source software (OSS). Each of these pieces is a potential source of risk and vulnerabilities.SBOM generation enables you to create a trackable inventory of these components. Yet, despite the importance of SBOMs for container security practices, only 36% of the respondents to the Anchore 2022 Software Supply Chain Report produce an SBOM for the containerized apps they build, and only 27% require an SBOM from their software suppliers.
[H2] Use Cases
An organization can use SBOMs for many purposes. The data inside an SBOM has internal uses such as Compliance review Security assessments License compliance Quality assurance Additionally, you can share an SBOM externally for compliance and customer audits. Within the security and development role, SBOMs serve a similar purpose as a bill of materials in other industries. For example, automotive manufacturers must track the tens of thousands of parts coming from a wide range of suppliers when manufacturing a modern car. All it takes is one faulty part to ruin the final product.Cloud-native software faces similar challenges. Modern applications use significant amounts of open source software that depends on other open source code which in turn incorporate further open source components. They also include internally developed code, commercial software, and custom software developed by partners. Combining components and code from such a wide range of sources introduces additional risks and potential for vulnerabilities at each step in the software development lifecycle. As a result, SBOMs become a critical foundation for getting a full picture of the “ingredients” in any software application over the course of the development lifecycle. Collecting SBOMs from software suppliers and generating SBOMs throughout the process to track component inventory changes and identify security issues is an integral first step to ensuring the overall security of your applications.Security and development teams can either request SBOMs from their software suppliers or generate an SBOM themselves. Having the ability to generate SBOMs internally is currently the more optimal approach. This way teams can produce multiple SBOMs throughout the development process to track component changes and search for known vulnerabilities as new issues become known in software.
[H2] SBOM Formats & Standards
SBOMs can be generated in a few formats or schemas that standardize the organization of the file’s contents. The most common formats are… CycloneDX SPDX (Software Package Data Exchange) SWID was previously listed as a third standard and was typically used by the U.S. federal government. It launched in 2009 and has now largely lost traction. Learn more about SBOM formats and standards, including a full comparison of Cyclone DX and SPDX.
[H2] A deeper dive into SBOM security benefits
There are many SBOM security benefits for your organization. Any effective solution to securing your software supply chain is transparency. Let’s dive into what SBOM security means with regard to these ingredients and why transparency is so vital.
[H3] Transparency = Discovering what is in there
It all starts with knowing what software is being used. You need an accurate list of “ingredients” (such as libraries, packages, and files) that are included in a piece of software. This list of “ingredients” is known as a software bill of materials. Once you have an SBOM for any piece of software you create or use, you can begin to answer critical questions about the security of our software supply chain.It’s important to note that SBOMs themselves can also serve as input to other types of analyses. A noteworthy example of this is vulnerability management and scanning. Typically, vulnerability scanning is a term for discovering known security problems with a piece of software based on previously published vulnerability reports. Detecting and mitigating vulnerabilities goes a long way toward preventing security incidents.In the case of software deployed in containers, developers can use SBOMs and vulnerability scans together to provide better transparency into container images. When performing these two types of analyses within a CI/CD pipeline, you need to realize two things: Each time you create a new container image (i.e. an image with a unique digest), you only need to generate an SBOM once. And that SBOM can be forever associated with that unique image.  Even though that unique image never changes, it’s vital to continually scan for known vulnerabilities. Many people scan for vulnerabilities once an image is built, and then move on. But new vulnerabilities are discovered and published every day (literally) — so it’s vital to periodically scan any existing images you’re already consuming or distributing to identify if they are impacted by new vulnerabilities. Using an SBOM means you can quickly and confidently scan an application for new vulnerabilities.
[H3] Why SBOMs matter for software supply chain security
Today’s software is complex, which is why SBOMs have become the foundation of software supply chain security. The role of an SBOM is to provide transparency about the software components of an application, providing a foundation for vulnerability analysis and other security assessments. For example, organizations that have a comprehensive SBOM for every software application they buy or build can instantly identify the impact of new zero-day vulnerabilities, such as the Log4Shell vulnerability in Log4j, and discern their exact location for faster remediation. Similarly, they can evaluate the provenance and operational risk of open source components to comply with internal policies or industry standards. These are critical capabilities when it comes to maintaining and actively managing a secure software supply chain. The importance of the SBOM was highlighted in the 2021 U.S. Executive Order to Improve the Nation’s Cybersecurity. The Executive Order directs federal agencies to “publish minimum SBOM standard” and define criteria regarding “providing a purchaser a software bill of materials (SBOM) directly or publish to a public website.” This Executive Order is having a ripple effect across the industry, as software suppliers that sell to the U.S. government will increasingly need to provide SBOMs for the software they deliver. Over time, these standards will spread as companies in other industries begin to mirror the federal requirements in their own software procurement efforts.If you’re looking for a deep dive into the world of software supply chain security, we have written a comprehensive guide to the subject.
[H2] What is an SBOM made of? What’s inside?
Each modern software application typically includes a large number of open source and commercial components coming from a wide range of sources. An SBOM is a structured list of components, modules, and libraries that are included in a given piece of software that provides the developer with visibility into that application. Think of an SBOM as a list of ingredients that evolves throughout the software development lifecycle as you add new code or components. Examples of items included in SBOMs are: The software packages, libraries, and modules used (open source, commercial, or proprietary) Metadata such as creation date, SBOM author, and format details (e.g., SPDX, CycloneDX) Dependencies, including direct and deeply nested Component version numbers and supplier details Associated open-source or commercial licenses The National Telecommunications and Information Administration (NTIA) defined minimum elements in July 2021 to provide a framework for organizations looking to comply with the Executive Order issued that same year. Anchore Enterprise supports SPDX, CycloneDX, and Syft formats. This is a continually evolving space with new formats introduced periodically. To learn about the latest on SBOM formats see the Anchore blog here.
[H2] Who needs SBOMs?
For the last several years, SBOMs have been used mainly by DevSecOps practitioners and compliance teams for audits, license monitoring, and compliance with industry-specific regulations. The rise of software supply chain attacks like the SolarWinds hack and the Log4Shell vulnerability in Log4j accelerated the adoption of SBOMs, and by 2024, nearly 50% of organizations were using the file to document software components, according to Anchore’s latest Software Supply Chain Security Report. Coupled with new compliance standards like the EU CRA, SBOM use is now on the radar for both security and development teams alike.
[H3] Security teams
SBOMs play a critical role for security teams, especially when it comes to vulnerability management. It is much quicker and easier to scan a library of SBOMs than it is to scan all of your software applications, and in the event of a zero-day vulnerability, every minute counts. SBOMs can also be leveraged by security teams to prioritize issues for remediation based on their presence and location and to create policies specific to software component attributes such as vendo