Webinar Description
Key Takeaways
- Explores why vendor-provided SBOMs and attestations are insufficient for managing third-party software risk
- Examines binary-first analysis and artifact forensics as alternatives to manifest-level scanning
- Addresses software acceptance policy development grounded in independent verification
- Relevant for security professionals, release managers, compliance teams and organisations in regulated industries
- Includes a live demonstration of independent software verification techniques
Introduction
Independently Verified SBOMs: Why Trust Is No Longer Enough is a webinar examining the limitations of traditional approaches to software supply chain security. Hosted by ReversingLabs, the session targets security professionals, release managers and compliance teams grappling with third-party software risk in an environment where vendor attestations and security questionnaires no longer provide adequate assurance. The timing reflects growing industry recognition that manifest-level Software Bills of Materials often fail to capture the true composition and risk profile of deployed software.
About This Event
This virtual webinar combines educational content with a live demonstration of independent software verification. The session is structured to help attendees understand why organisations should generate and verify their own SBOMs rather than relying solely on vendor-supplied documentation. ReversingLabs presents its perspective on building software acceptance policies that prioritise evidence over trust, drawing on its Spectra Assure platform to illustrate practical implementation.
The Shift from Trust to Verification
Software supply chain security has traditionally depended on vendor attestations, security questionnaires and contractual assurances. Organisations accepted third-party software based on documentation provided by the vendor, supplemented by periodic audits or compliance certifications. This model assumed that vendors accurately represented their software’s composition and security posture.
Recent high-profile supply chain compromises have exposed the fragility of this trust-based approach. Attackers have demonstrated that compromising a single vendor can provide access to thousands of downstream organisations. The resulting industry response has accelerated interest in SBOMs as a mechanism for understanding software composition, but the webinar argues that simply receiving an SBOM from a vendor does not resolve the underlying trust problem.
Limitations of Vendor-Provided SBOMs
Vendor-generated SBOMs typically derive from build manifests and dependency declarations rather than analysis of the actual compiled software. This manifest-level approach captures what the vendor intended to include but may miss components introduced during the build process, bundled dependencies or malicious modifications. The gap between declared and actual composition represents a significant blind spot for organisations attempting to assess risk.
Independent verification addresses this gap by analysing the binary artifacts that organisations actually deploy. Binary-first analysis examines compiled software to identify components, detect anomalies and verify that the delivered software matches its documentation. This approach treats the SBOM as a claim to be verified rather than a fact to be accepted.
Binary Analysis and Artifact Forensics
The distinction between source code analysis and binary analysis is central to the webinar’s thesis. Source code analysis examines software before compilation, identifying vulnerabilities and coding issues in the development environment. Binary analysis examines software after compilation, revealing what actually exists in the deployable artifact. Both approaches serve different purposes, but binary analysis provides the definitive view of what an organisation will run in production.
Artifact forensics extends this concept by examining software packages for signs of tampering, unexpected components or behavioural anomalies. This deeper inspection can identify supply chain compromises that manifest-level scanning would miss, including backdoors inserted during the build process or malicious code hidden within legitimate dependencies.
Building Evidence-Based Acceptance Policies
The webinar advocates for organisations to establish software acceptance policies that require independent verification before deployment. Rather than accepting vendor claims at face value, these policies mandate that organisations generate their own SBOMs from binary analysis and compare results against vendor documentation. Discrepancies trigger investigation before software enters production environments.
This approach is particularly relevant for organisations in regulated industries such as finance, healthcare, energy and the public sector, where software supply chain integrity increasingly falls under regulatory scrutiny. Gartner has noted the growing importance of software supply chain security, and regulatory frameworks are beginning to require demonstrable assurance rather than mere attestation.
Who Should Attend
The session is designed for application security professionals, DevSecOps practitioners, security architects and release managers responsible for software deployment decisions. IT risk and compliance teams will find value in understanding how independent verification supports regulatory requirements. CISOs and security leadership seeking to strengthen their organisation’s software supply chain posture will gain insight into emerging best practices and the limitations of current approaches.