Blog
SLSA Secures the Build. Who Secures the SBOM?
Modern software supply chain security is built on evidence. Organizations need confidence in what software contains, whe...
🔀 Convergence in SBOM Signing
“Don’t roll your own crypto.” It’s the first rule of security engineering, and it turns out it’s ...
An Interesting and Useful Visualization for Security Teams
Zero Day Clock: https://zerodayclock.com/ The Zero Day Clock tracks how quickly ...
The SBOM Storage Tax: Optimization at Scale
Following my last post on the “Storage Tax” of binary blob signing, I received some insightful feedback from the co...
The SBOM Signature 'Storage Tax': Money Talks 💰📉
Over the last few weeks, I’ve been deep in the weeds of technical best practices for signing SBOMs. I’ve discussed ...
🚨 Call for Feedback: A Standardized Approach to SBOM Signing
The new benchmark by which all SBOM signing and verification tools will be judged. This Frida...