Description

Are you ready to master Software Bill of Materials (SBOM) and become the supply chain security expert your organisation needs in 2026?Software supply chain attacks increased by 245% year-over-year. SolarWinds, Log4Shell, XZ Utils, and 3CX proved one brutal truth: you cannot defend what you cannot see. SBOM is the visibility layer that changes everything — and organisations that implement it respond to critical CVEs in seconds, not weeks.— What is SBOM and why does it matter right now?A Software Bill of Materials (SBOM) is a machine-readable inventory of every component, library, and dependency inside a software product. Executive Order 14028 requires it for all software sold to the US federal government. The EU Cyber Resilience Act mandates it for all CE-marked products by December 2027. The FDA requires it in premarket submissions for medical devices. SBOM is no longer optional — it is a compliance requirement, a procurement expectation, and a security necessity.Yet 86% of organisations find SBOM generation challenging, and most security teams still lack the skills to implement it correctly. This course closes that gap completely.— What You Will Learn- Understand the full software supply chain threat landscape — SolarWinds, Log4Shell, XZ Utils, 3CX anatomy explained- Generate SBOMs using Syft, Trivy, cdxgen, and CycloneDX build plugins- Master SPDX (ISO/IEC 5962:2021), CycloneDX (ECMA-424), and SWID Tags- Integrate SBOM generation into CI/CD pipelines — GitHub Actions, GitLab CI, Jenkins- Deploy OWASP Dependency-Track for enterprise SBOM management and continuous CVE monitoring- Implement VEX workflows to triage and communicate CVE exploitability status- Enforce open-source license compliance with automated policy gates- Meet EO 14028, NTIA, EU CRA, FDA, and NIST SSDF requirements- Write SBOM contractual language for supplier procurement- Sign SBOMs with cosign (Sigstore) for tamper-evident attestation- Respond to zero-day CVEs and supply chain compromises using SBOM-powered scope determination- Build a mature SBOM program from MVP to Level 4 — with 8 measurable KPIs— Hands-On Labs- Generate your first SBOM in under 5 minutes with Syft- CI/CD pipeline YAML for GitHub Actions and Dependency-Track- Configure policy gates blocking critical CVEs and prohibited licenses- Set up OWASP Dependency-Track with Docker Compose- Apply the 10-point OSS intake checklist- Use the 72-hour CVE response runbook— 13 Modules covering: Threat Landscape · SBOM Fundamentals · SPDX vs CycloneDX · Syft & Trivy Tools · SDLC Integration · Vulnerability Management · License Governance · Regulatory Compliance · Procurement · SBOM Operations · Incident Response · Program Maturity · Certification Path— Regulatory Coverage: EO 14028 · NTIA Minimum Elements · OMB M-22-18 · FDA Cybersecurity · NIST SSDF · EU Cyber Resilience Act · EU NIS2—Enrol now and build the supply chain security visibility your organisation needs — before a CVE forces the question.