What is SBOM, and why is it important in GitHub Advanced Security?

• A. Software Barometer of Maturity
• B. SBOM stands for Software Bill of Materials; it inventories components and dependencies to improve supply chain transparency and vulnerability management.
• C. Software Bill of Management
• D. System Baseline of Modules

Answer: (B)

SBOM stands for Software Bill of Materials, and it is a comprehensive, machine-readable inventory of every component that goes into a software product—the libraries, frameworks, dependencies, and their exact versions. Think of it as a parts list for software. In GitHub Advanced Security, this visibility is crucial because it makes the software supply chain transparent. With an SBOM, security teams can see exactly which components are included, including transitive dependencies, and map any known vulnerabilities to the specific versions in use. This enables precise, prioritized remediation, reduces blind spots, and supports governance and licensing checks. SBOMs also speed up incident response by letting you quickly determine whether a compromised component is part of your product. They’re commonly generated in standard formats like SPDX or CycloneDX so security tools can consume and correlate the data with vulnerability databases and GHAS results.