Why Using SCA to Build Your SBOMs is a Risky Proposition

ReversingLabs' research finds that SBOMs produced from software manifests capture only ~49.91% of components in final packages, leaving developers and security teams blind to many dependencies, proprietary or commercial code, and late-stage additions; the report argues that manifest-based SCA is insufficient and advocates complex binary analysis (Spectra Assure) to generate complete SBOMs/xBOMs and detect vulnerabilities, malware, tampering, and other risks in shipped binaries.