How do you interpret SBOM results for risk prioritization?

• A. Count the total number of dependencies and compare to previous runs.
• B. Only focus on the number of licenses without considering vulnerabilities.
• C. Look at vulnerable components, outdated versions, and licenses; map to exposure and remediation actions.
• D. Ignore licenses when prioritizing risk.

Answer: (C)

Evaluating SBOM results for risk prioritization means weighing the security exposure of each component rather than just tallying what’s present. An SBOM reveals what libraries and modules are in your software, their versions, and their licenses, so you prioritize by looking at vulnerable components (the CVEs, severity, and how easily they could be exploited), outdated versions (which may no longer receive patches), and the licenses in use (which can introduce legal or compliance risk). Then map that information to concrete exposure and remediation actions: fix or upgrade high-severity vulnerabilities that could impact your systems or data, address components with unpatched or end-of-life versions, and ensure license terms align with policy or replace licenses that pose compliance risks. This approach moves beyond simply counting dependencies or counting licenses, and it avoids ignoring licenses, by tying each factor to actionable steps and policy considerations.