Revenera Launches New Software Composition Analysis Solution for Creation, Aggregation and Management of Software Bill of Materials

“Revenera SBOM Insights enables software suppliers to ingest data from a wide range of sources, unifying all SBOMs across the organization into a single, actionable view to easily identify outdated components, security vulnerabilities, and open source license compliance issues,” said Nicole Segerer, SVP and General Manager of Revenera. “When the next high-profile vulnerability hits, suppliers will have unified data at their fingertips to quickly uncover exposure wherever it exists in their enterprise and expediently fix problems in their applications; no matter if the code was developed internally or outside the organization.” 

Demand for SBOMs Continues to Skyrocket 

The Biden administration’s Executive Order on Improving the Nation’s Cybersecurity, along with existing regulations and recommended best practices from various industry groups (including PCI, FDA, NTIA, and CISA), have acted as a wakeup call for software suppliers to focus on creating a formally structured and machine-readable listing of all software components, open source software (OSS) and third-party commercial software found within their applications.  

According to the July 2022 Gartner® report entitled “Hype Cycle™ for Open-Source Software, 2022,” “By 2025, 60% of organizations building or procuring critical infrastructure software will mandate and standardize software bills of materials (SBOMs) in their software engineering practice, up from less than 20% in 2022.” 

Comprehensive, Actionable SBOMs Require Data Aggregation 

To meet this need, software suppliers are turning to software composition analysis (SCA) vendors to provide tools that help discover and report on a complete list of components included in their applications. Software suppliers require a comprehensive SBOM solution for all code in use. Along with the SBOMs constructed internally, a complete SBOM must collect information from upstream supply chain partners, third-party developers, and private software suppliers.  

Aggregating this data into a single actionable view provides complete visibility for development, security, legal, and open source program office (OSPO) teams, along with downstream supply chain partners. Having this information at their fingertips allows these groups to act on the unified SBOM data for better supply chain transparency, alerting for new issues, and impact analysis when new vulnerabilities are discovered. 

Introducing Revenera SBOM Insights 

Revenera SBOM Insights gives organizations the ability to manage security and legal risk by maintaining a complete and accurate SBOM in the cloud. This cloud inventory management solution expands the level of transparency into organizations’ products beyond the code under their control by aggregating the SBOM over multiple data sources and providing full visibility to security and legal teams as well as supply chain partners. After ingesting data from multiple sources, Revenera SBOM Insights reconciles SBOM parts from internal and external SBOMs into a single actionable view across an organization’s portfolio of applications, turning the SBOM into an ongoing source of truth.  

Revenera SBOM Insights features include: 

• Management of a complete SBOM in the cloud 

• Data ingested from a wide range of sources, unifying internal and external SBOMs across an organization into a single actionable view 

• Insights about component and license usage 

• Insights into security and vulnerability exposures 

• Generation of compliance artifacts for customers and downstream supply chain partners 

• Alerting and impact analysis for newly discovered security and compliance issues 

• Visibility into SBOM changes over time 

To learn more about Revenera SBOM Insights: 

• Blog 

• Video 

• Datasheet 

• Product Overview

  *Gartner, “Hype Cycle for Open-Source Software, 2022”, Oleksandr Matvitskyy, Mark Driver, Anne Thomas, July 20, 2022. GARTNER and HYPE CYCLE are registered trademarks and service marks of Gartner, Inc. and/or its affiliates in the U.S. and internationally and are used herein with permission. All rights reserved.