Rise of the xBOM: The new go-to tool for software security

The report argues that traditional SBOMs provide incomplete visibility for modern software and advocates adopting CycloneDX’s broader xBOM approach to capture services, AI/ML models, and cryptographic assets. It highlights three core xBOM types—ML‑BOMs (for model and data provenance), SaaSBOMs (for rapidly changing service dependencies), and CBOMs (for cryptographic materials)—and emphasizes the need for API-driven, automated, and dynamic transparency integrated into build pipelines. An example of malware distributed via Pickle-serialized ML models underscores emerging ML supply chain risks and the value of expanded transparency.