Your biggest customer just asked for an SBOM. Here's what to do.

One day an email lands from your biggest customer's security team. It asks, politely, for two things: a Software Bill of Materials, and your current vulnerability status.

If your reaction is a small jolt of "…our what?", you're in the majority. And you're not behind, you're early to a question that's about to become routine.

What they're actually asking

A Software Bill of Materials (SBOM) is just an ingredients list. Every third-party library, framework and package your software is built from, with versions. That's it. The "vulnerability status" part is: which of those ingredients have known security problems, and are any of them being actively exploited right now.

Why now? Two forces are converging. Big organisations are tightening supply-chain security, because that's where the nasty breaches keep coming from. And the EU Cyber Resilience Act is about to make this kind of transparency a legal expectation across the market. Your customer's security team is getting ahead of both.

Why "give us a week" is the wrong answer

Here's the uncomfortable part for most small vendors: they can't actually answer the question quickly. Dependencies pile up over years. Nobody kept a list. Producing one by hand means a developer spelunking through the project for an afternoon, and doing it again next quarter when the next customer asks.

In a procurement conversation, "give us a week to find out" reads as "we don't know what's in our own product." That's not the impression you want to leave with the people deciding whether to renew.

How to answer in an hour

The good news: this is a solved problem, and the core tools are free. You need three things:

• An SBOM - generated automatically from your project's lockfile. Minutes, not days.
• A vulnerability match - cross-reference those dependencies against public vulnerability databases.
• An exploited-in-the-wild filter - because a list of 200 theoretical CVEs helps nobody; what a customer (and a regulator) cares about is the handful being actively exploited.

Put those together and the scary email becomes a two-page answer you can send back the same morning. That's the whole game: not avoiding the question, but being the vendor who can answer it while your competitor is still promising to get back to them.