Typically, there are a few fundamental challenges that SBOMs face that pose a problem for their adaption into the industry:
Consistency - Although the White House has now set a specific definition for SBOMs in their EO, the exact specification of what distinct companies include in this still differs. With this, the accuracy and consistency across SBOMs issued by different companies can generate blind spots or missing information. Additionally, many companies are still using manual strategies to craft their SBOMs, leading to critical data and component information being left out. Provenance and ongoing management certainly become too complex, especially with continued security threats and vulnerabilities such as Log4Shell.
Updating - When there’s a new software release, they must produce and distribute a new SBOM. For platforms that are regularly updating, this scales the physical demand of producing an SBOM, with companies that are not using the correct tools having to take large amounts of time to produce their SBOM. This is a further demonstration that SBOMs need to be produced automatically, or else the additional work is simply too much to maintain.
Connection - What is shared or produced for the sake of transparency becomes an issue with downstream and upstream partners in the software supply chain, with the possibility that the SBOM is incomplete and inaccurate. Insert your customer in the process who is potentially not getting the full story of what’s in the code you’re passing on to them. When lacking certain details or knowledge areas, an SBOM becomes ineffective and could lead to potential exploits.