BLACK HAT Q&A: SBOM claims what went in, binary shows what shipped, the risk lies between

The article discusses how software bill of materials (SBOM) inventories are often incomplete — a problem amplified by AI-assisted code generation, which frequently inserts undeclared open-source snippets. This creates legal risks (license violations) and security gaps (undiscovered vulnerabilities like Log4Shell), with Insignary research showing substantial rates of undeclared components; the author concludes organizations need independent verification of SBOMs to ensure software provenance and mitigate risk.