No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild
Empirical analysis of 78K SBOMs reveals most lack dependency edges entirely, meaning vulnerability reachability and impact analysis built on them are unreliable—a critical gap as CRA mandates approach.
Summary written by editorial AI · Source link below
arXiv:2607.22140v3 Announce Type: replace-cross Abstract: Software Bills of Materials (SBOMs) are consumed not only as component inventories but as dependency graphs: vulnerability triage, reachability filtering, and impact analysis all traverse the edges an SBOM declares. We present the first large-scale characterization of the declared dependency graph across 78,612 real-world SBOM files from the Wild SBOMs dataset (77,092 parseable). We find that the population splits into three regimes: 52.
Editorial Analysis
Enterprises relying on SBOMs for CRA and NIS2 compliance may find their vulnerability triage fundamentally flawed if dependency graphs are absent, creating false confidence in software supply-chain security.
Audit SBOMs from your top 20 suppliers for dependency-edge completeness and flag any that are flat component lists only.
Most software bills of materials in circulation lack the dependency data needed for reliable vulnerability analysis, creating blind spots in supply-chain risk management ahead of CRA deadlines.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at arXiv Crypto & Security in a new tab.
More from the DevSecOps Desk
- Nearly 1.5 million exposed secrets targeted in new revocation program4d
- From Lab to Reality: A Practical Evaluation of Deep Learning Models and LLMs for Vulnerability Detection4d
- A.S.E 2.0: Understanding How Repository Context Impacts the Security of LLM-Generated Code4d
- A Hybrid Approach for Automated Security Pattern Recovery4d
- Chainguard endpoints now handle breaking changes5d