Log4j

Allan Friedman on SBOM Evolution, AI BOMs, VEX and the Future of Software Transparency

Allan Friedman, a key figure in early SBOM policy work, joined the SecurityWeek Podcast to explain why software transparency has moved beyond compliance into operational necessity. He stressed that modern applications are assembled from layers of dependencies, open source components, third-party libraries, AI models and external data sources. The real value of an SBOM lies not in its creation but in how organizations and suppliers use the data during incidents such as Log4j-style vulnerabilities or supply-chain compromises. Friedman highlighted VEX as a critical companion that helps distinguish between the presence of a vulnerable component and actual exploitability, reducing alert fatigue. He also described the emergence of AI BOMs to document models, training data, runtime sources and agentic behaviors that traditional inventories cannot capture. The discussion covered interoperability challenges, redaction options for proprietary concerns, and the potential convergence of SBOM, cryptographic BOMs and hardware BOMs into a broader transparency ecosystem. Ultimately, Friedman framed SBOM as essential data that enables defenders to correlate dependencies with threats and make timely risk decisions.