Software Bill of Materials in Software Supply Chain Security A Systematic Literature Review

TL;DR

This systematic review examines how SBOMs are used in software supply chain security, identifies adoption barriers, and highlights gaps in current research to guide future advancements.

Contribution

It synthesizes existing evidence on SBOM applications, maps barriers to quality models, and identifies research gaps in machine learning and quality assurance for SBOMs.

Findings

SBOMs are used for vulnerability management, transparency, and risk assessment.

Major barriers include standardization, privacy, and maintenance challenges.

Research gaps include limited use of machine learning and quality assurance techniques.

Abstract

Software Bill of Materials (SBOMs) are increasingly regarded as essential tools for securing software supply chains (SSCs), yet their real-world use and adoption barriers remain poorly understood. This systematic literature review synthesizes evidence from 40 peer-reviewed studies to evaluate how SBOMs are currently used to bolster SSC security. We identify five primary application areas: vulnerability management, transparency, component assessment, risk assessment, and SSC integrity. Despite clear promise, adoption is hindered by significant barriers: generation tooling, data privacy, format/standardization, sharing/distribution, cost/overhead, vulnerability exploitability, maintenance, analysis tooling, false positives, hidden packages, and tampering. To structure our analysis, we map these barriers to the ISO/IEC 25019:2023 Quality-in-Use model, revealing critical deficiencies in SBOM trustworthiness, usability, and suitability for security tasks. We also highlight key gaps in the literature. These include the absence of applying machine learning techniques to assess SBOMs and limited evaluation of SBOMs and SSCs using software quality assurance techniques. Our findings provide actionable insights for researchers, tool developers, and practitioners seeking to advance SBOM-driven SSC security and lay a foundation for future work at the intersection of SSC assurance, automation, and empirical software engineering.