Transforming SBOMs from Compliance Burden to Security Asset

Learn how to transform Software Bill of Materials (SBOMs) from compliance requirements into strategic security assets through this 34-minute conference talk from DevConf.IN 2026. Discover how speakers Martin Sikora and Ales Raszka built an automated SBOM lifecycle into Konflux, a Kubernetes-native software factory system, addressing the challenge of maintaining accurate and verifiable records at scale without disrupting build processes. Explore the technical implementation of Mobster, an automated tool that generates, enriches, and stores SBOMs for every production build, ensuring transparent dependency tracking for container images. Examine how SBOM data integration with the Trusted Profile Analyzer enables portfolio-wide visibility and strategic security decision-making beyond simple per-build compliance. Understand the architectural approach to capturing metadata and dependencies during builds, the importance of industry standards like SPDX and CycloneDX for data portability, and theoretical frameworks for mapping vulnerabilities across thousands of components. Gain insights into empowering product security teams with centralized SBOM data for querying entire software catalogs, identifying high-risk dependencies, and orchestrating rapid large-scale remediation across multiple products.