Viktor Petersson's QCon London 2026 talk covers the growing legal pressure on software teams to adopt SBOMs, driven by the EU Cyber Resilience Act (enforcement starting September 2026), US Executive Order 14028, FDA requirements, and PCI-DSS 4.0. He explains the two dominant SBOM formats—SPDX and CycloneDX—and outlines a four-stage pipeline for high-quality SBOM generation: creation, augmentation, enrichment, and signing. Petersson warns against common mistakes like using generic scanners on large Docker images, skipping signing, and merging multi-ecosystem SBOMs. He also introduces the Transparency Exchange API (TEA), an OWASP/ECMA initiative for standardized SBOM distribution, and stresses that versioned SBOM lifecycle management is as critical as source code version control.
Sort: