The Four Dimensions of SBOM Quality
Completeness: Does the SBOM include all components — direct dependencies, transitive dependencies, OS packages in containers, and bundled binaries? A shallow SBOM that only lists top-level dependencies misses the components where the majority of vulnerabilities typically reside. Completeness is measurable by comparing the component count against expected counts for the application type and technology stack.
Accuracy: Are the component identifiers (names, versions, PURLs) correct and precise? Incorrect PURLs prevent accurate matching against vulnerability databases. Imprecise versions ("1.x" instead of "1.2.3") make CVE matching unreliable. Accuracy can be spot-checked by verifying that SBOM-listed components and versions match the actual resolved packages in the build.
Depth: Does the SBOM include enriched metadata beyond minimum elements — license data, cryptographic hashes, supplier information, end-of-life status? Depth determines how many downstream use cases the SBOM can support. A shallow SBOM supports vulnerability scanning. A rich SBOM also supports license compliance, provenance verification, and maintenance health assessment.
Freshness: How current is the SBOM relative to the deployed software? An SBOM generated six months before a deployment reflects the state of the software at build time, not the current state. CISA's 2025 updated guidance addresses SBOM freshness requirements, suggesting that SBOMs should be regenerated on every build and that stale SBOMs (older than a defined threshold) should be flagged.
Automated SBOM Quality Assessment
CISA has published the SBOM Quality and Sharing Capability, and OWASP's Quality Metrics working group has produced tooling for automated SBOM quality scoring. Tools like sbom-scorecard and bomutils can evaluate an SBOM against a defined quality framework and produce a score that enables comparison across SBOMs from different sources.
What to Require from Vendor SBOMs
When evaluating SBOMs received from software vendors, check: that PURLs are present for every component; that version strings are exact resolutions, not ranges; that the dependency graph is included; that the SBOM timestamp is within your defined freshness window; and that the SBOM covers transitive dependencies, not just top-level packages. Rejecting low-quality vendor SBOMs creates market pressure for quality improvement across the ecosystem.
High-Quality SBOMs with Every Fossity Build
Fossity — Fossity generates SBOMs that score highly across all four quality dimensions — complete transitive coverage, accurate PURLs and CPEs, rich metadata including licenses and hashes, and freshness baked in through CI/CD integration. Quality SBOMs you can actually rely on.
Visit Fossity.com →