---
title: Why the SBOM is just the beginning of software supply chain cybersecurity
description: The more daily life becomes software dependent, the more urgent the need for organizations deploying software – including federal agencies.
image: https://blog.riskrecon.com/hubfs/FNN%20SBOM%20interview%20Oct%202023.png
---

- [Blog](https://blog.riskrecon.com)
- [Partners](https://www.riskrecon.com/partners-riskrecon)
- [Academy](https://www.riskrecon.com/academy)
- [Login](https://portal.riskrecon.com/)

[![riskrecon by-1](https://blog.riskrecon.com/hs-fs/hubfs/riskrecon%20by-1.png?width=640&height=276&name=riskrecon%20by-1.png "riskrecon by-1")](https://www.riskrecon.com/)

- Solutions 
    - Industries 
          - [Finance](https://www.riskrecon.com/solutions/finance)
          - [Insurance](https://www.riskrecon.com/solutions/insurance-providers)
          - [Healthcare](https://www.riskrecon.com/solutions/healthcare-providers)
          - [Energy](https://www.riskrecon.com/solutions/energy-companies)
          - [Defense](https://www.riskrecon.com/solutions/defense-companies)
    - Use Cases 
          - [Third-Party Risk Management](https://www.riskrecon.com/solutions/third-party-risk-management)
          - [Supply Chain Risk Management](https://www.riskrecon.com/solutions/supply-chain-risk-management)
          - [Enterprise Risk Management](https://www.riskrecon.com/solutions/enterprise-risk-management)
          - [Mergers & Acquisitions](https://www.riskrecon.com/solutions/mergers-and-acquisitions)
- Why RiskRecon 
    - The RiskRecon Difference 
          - [Deep Assessment](https://www.riskrecon.com/why-riskrecon#deep-assessment)
          - [Risk Prioritized](https://www.riskrecon.com/why-riskrecon#custom-risk-prioritization)
          - [Efficient](https://www.riskrecon.com/why-riskrecon#efficient)
          - [Accurate](https://www.riskrecon.com/why-riskrecon#accurate)
- Company 
    - [Team](https://www.riskrecon.com/team)
    - News & Events 
          - [News Releases](https://blog.riskrecon.com/company/news-releases)
          - [Media Coverage](https://blog.riskrecon.com/company/media-coverage)
          - [Events](https://blog.riskrecon.com/company/events)
    - [Our Story](https://www.riskrecon.com/our-story-riskrecon)
    - [Contact Us](https://www.riskrecon.com/contact-us)
- Resources 
    - RiskRecon Insights 
          - [SolarWinds Breach Resources](https://www.riskrecon.com/resources-for-the-solarwinds-hack-riskrecon)
          - [RiskRecon Academy](https://www.riskrecon.com/academy)
          - [RiskRecon Ratings Model](https://www.riskrecon.com/cybersecurity-risk-rating-model)
          - [Blog](https://blog.riskrecon.com)
          - [Videos & Webinars](https://blog.riskrecon.com/resources/videos-and-webinars)
          - [Reports & White Papers](https://blog.riskrecon.com/resources/reports-and-whitepapers)

[![Know Your Rating](https://no-cache.hubspot.com/cta/default/2477095/95b2ee26-9922-486c-b700-3f9787354737.png)](https://cta-redirect.hubspot.com/cta/redirect/2477095/95b2ee26-9922-486c-b700-3f9787354737)

[![Request A Demo](https://no-cache.hubspot.com/cta/default/2477095/05774d1d-8cef-4232-8ecd-58507f18116a.png)](https://cta-redirect.hubspot.com/cta/redirect/2477095/05774d1d-8cef-4232-8ecd-58507f18116a)

#### Cyber Crisis Exercising: The Way Forward

Discover how cyber crisis exercising helps organizations build real resilience and respond effectively under pressure.

[Read More**](https://www.riskrecon.com/cyber-crisis-exercising-the-way-forward)

#### Free 3PTY Ratings

Get a free 30-day trial of the RiskRecon portal and see the ratings of up to 50 vendors.

[Read More**](https://www.riskrecon.com/know-your-portfolio)

#### Blog: Why Most Third-Party Risk Tools Miss Critical Issues and What Enterprises Can Do About It

This blog takes a closer look at why third-party cyber risk tools often miss critical vendor issues and what a more effective approach looks like.

[Read More**](https://blog.riskrecon.com/why-most-third-party-risk-tools-miss-critical-issues-and-what-to-do-about-it)

##### September 29, 2023

# Why the SBOM is just the beginning of software supply chain cybersecurity

The more daily life becomes software dependent, the more urgent the need for organizations deploying software – including federal agencies – to ensure security in the software supply chain.

That supply chain has several main channels, principally open source components, custom coded and commercial applications.

“There’s not necessarily clean delineation. Those can all kind of come together in one unit,” said Kelly White, the co-founder and CEO of RiskRecon, a Mastercard company.

The software supply chain security question has developed in stages, White said. His own cybersecurity experience dates to when the principal concern was safe code for custom applications. The Open Web Application Security Project (OWASP), established in the late 1990s, still guides people coding and deploying online applications. The widespread adoption of open source components somewhat later.

[Watch the full interview with Kelly White on the Federal News Network. ](https://federalnewsnetwork.com/federal-insights/2023/09/why-the-sbom-is-just-the-beginning-of-software-supply-chain-cybersecurity/)

- [**](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fblog.riskrecon.com%2Fresources%2Fvideos-and-webinars%2Fwhy-the-sbom-is-just-the-beginning-of-software-supply-chain-cybersecurity)
- [**](https://twitter.com/intent/tweet?original_referer=https://blog.riskrecon.com/resources/videos-and-webinars/why-the-sbom-is-just-the-beginning-of-software-supply-chain-cybersecurity)
- [**](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fblog.riskrecon.com%2Fresources%2Fvideos-and-webinars%2Fwhy-the-sbom-is-just-the-beginning-of-software-supply-chain-cybersecurity)

[![FNN Industry Exchange Jan 2023](https://blog.riskrecon.com/hs-fs/hubfs/FNN%20Industry%20Exchange%20Jan%202023.jpg?width=250&name=FNN%20Industry%20Exchange%20Jan%202023.jpg)

## Cyber hygiene critical in verifying suppliers’ cybersecurity posture

](https://federalnewsnetwork.com/cybersecurity/2023/01/cyber-hygiene-critical-in-verifying-suppliers-cybersecurity-posture/)

[![riskrecon_by_mc_rgb_rev](https://blog.riskrecon.com/hs-fs/hubfs/2020_RR/riskrecon_by_mc_rgb_rev.png?width=150&height=74&name=riskrecon_by_mc_rgb_rev.png "riskrecon_by_mc_rgb_rev")](https://www.riskrecon.com/)

Locations:

Murray, UT  
Boston, MA

E: [sales@riskrecon.com](mailto:sales@riskrecon.com)

[![Contact Us](https://no-cache.hubspot.com/cta/default/2477095/bf45a9b1-2774-4be7-88e8-3edd40ff6445.png)](https://cta-redirect.hubspot.com/cta/redirect/2477095/bf45a9b1-2774-4be7-88e8-3edd40ff6445)

#### Solutions

- [RiskRecon Cyber Ratings](https://www.riskrecon.com/solutions/riskrecon-by-mastercard)
- [RiskRecon Privacy Ratings](https://www.riskrecon.com/solutions/riskrecon-privacy)
- [RiskRecon Assessments](https://www.riskrecon.com/solutions/riskrecon-assessments)
- [Cyber Quant](https://www.riskrecon.com/solutions/mastercard-cyber-quant)
- [Threat Protection](https://www.riskrecon.com/solutions/mastercard-threat-protection)

#### Use Cases

- [Third-party diagnostic & prioritization](https://www.riskrecon.com/use-case/third-party-portfolio-diagnostic)
- [Cyber Attack Protection](https://www.riskrecon.com/mastercard-threat-protection)
- [Cyber Risk Quantification](https://www.riskrecon.com/solutions/mastercard-cyber-quant)
- [Supply Chain Monitoring](https://www.riskrecon.com/use-case/supply-chain-monitoring-and-visualization)
- [Own Enterprise Monitoring](https://www.riskrecon.com/use-case/own-enterprise-subsidiary-monitoring)

#### Company

- [Why RR](https://www.riskrecon.com/why-riskrecon)
- [Our Story Leadership](https://www.riskrecon.com/team#leadership)
- [Partners](https://www.riskrecon.com/partners-riskrecon)
- [Careers](https://careers.mastercard.com/us/en/search-results?keywords=riskrecon)
- [Privacy Policy](https://www.mastercard.us/en-us/vision/corp-responsibility/commitment-to-privacy/privacy.html?hsLang=en)
- [Terms of Use](https://www.riskrecon.com/terms-of-use)

#### Resources

- [Academy](https://www.riskrecon.com/academy)
- [Blog](https://blog.riskrecon.com/)
- [Events](https://blog.riskrecon.com/company/events)
- [Reports and WPs](https://blog.riskrecon.com/resources/reports-and-whitepapers)
- [Videos & Webinars](https://blog.riskrecon.com/resources/videos-and-webinars)
- [Ratings Model](https://www.riskrecon.com/cybersecurity-risk-rating-model)

Follow us:

[**](https://www.facebook.com/riskrecon) [**](https://twitter.com/riskrecon) [**](https://www.linkedin.com/company/riskrecon/)

© Copyright 2026. | [Privacy Policy](https://www.riskrecon.com/privacy-policy) | [Terms of Use](https://www.riskrecon.com/terms-of-use)

 Manage Cookies