The Missing Link: How We Collect and Leverage SBOMs
How Schneider Electric generates, stores, and operationalizes thousands of product SBOMs to accelerate CERT incident response.
Summary
Operationalizing SBOMs at Scale
Software Bills of Materials (SBOMs) provide visibility into software dependencies, but collecting and maintaining them across large enterprise product portfolios poses significant operational challenges.
Enterprise Implementation at Schneider Electric
Schneider Electric updated internal policies and automated tooling to generate, collect, and store thousands of product SBOMs. This centralized inventory enables the corporate Product CERT to rapidly pinpoint vulnerable components across product lines.
Incident Response During Major Disclosures
Real-world case studies during the Log4j and OpenSSL vulnerability events demonstrate how structured SBOM data cut triage times from weeks to hours, allowing rapid customer guidance and remediation.
Related talks
FIRST·36 min
Presenters detail vulnerability discovery and exploitation in Contextual SBOMs: Unlocking Precise Vulnerability Management with Build-Time Content Intelligence.
Community Stage·53 min
Tom Berek · Farid Zakaria · D Baker
Explores how Nix and NixOS provide reproducible software builds, declarative dependency management, and SBOM traceability across homelabs and enterprise environments.
Community Stage·53 min
Tom Berek · Farid Zakaria
Tom Berek and Farid Zakaria dive into reproducible builds, Nixpkgs dependency isolation, and SBOM verification using Nix and NixOS.