How can you use the SBOM to respond to a zero-day vulnerability?

• A. SBOM cannot be used for zero-day responses.
• B. Identify affected components in the SBOM, locate versions and vendors, and coordinate patches and mitigations with maintainers.
• C. Patch all components regardless of SBOM findings.
• D. Rely on external advisories only.

Answer: (B)

The main idea here is using an SBOM to map a zero-day vulnerability to your actual software inventory, so you can target fixes efficiently. An SBOM enumerates every component you include, along with its version and vendor. When a zero-day is disclosed, you don’t want to guess which parts in your product are at risk. By cross-referencing the advisory’s affected components and versions with your SBOM, you can quickly identify which of your deployed assets are impacted.

With that knowledge, you can coordinate patches and mitigations with the maintainers of those components. This means you can pull in official patches as they become available, verify and test them in your environment, and plan mitigations if a patch is not yet released. This targeted approach minimizes unnecessary changes, reduces risk from unnecessary updates, and helps prioritize remediation where the exposure is highest.

It’s not just about having advisories; the SBOM provides the inventory visibility needed to apply those advisories to your specific products. Choosing to patch everything without referencing the SBOM wastes effort and can introduce stability issues. Relying only on external advisories misses the crucial step of mapping those advisories to your actual components, so you’d either miss affected assets or over-patch.