Software transparency becomes cyber-security priority

Software supply chain security is moving beyond vulnerability management towards full transparency, as organisations prepare for new regulatory requirements under the EU’s Cyber Resilience Act (CRA).

New findings from the European Union Agency for Cybersecurity show that organisations are accelerating adoption of Software Bills of Materials (SBOMs) ahead of the CRA, which will require manufacturers of products with digital elements to create, maintain and, where necessary, provide an inventory of the software components within their products.

An SBOM gives organisations greater visibility into open-source libraries, third-party dependencies and software components, making it easier to identify vulnerable packages, assess supplier risk and respond more quickly when new vulnerabilities emerge. As software supply chains become increasingly complex, that visibility is becoming a core element of product security rather than a compliance exercise.

ENISA’s research found that many organisations have already begun investing in SBOM tooling and automation, with adoption expected to accelerate before the CRA takes effect in December 2027. The shift reflects growing recognition that organisations cannot secure software they do not fully understand.

For security leaders, the message is straightforward: software transparency is becoming as important as vulnerability management itself. Knowing what is inside an application may soon be as critical as knowing whether it contains a vulnerability.