Topic starter
02/08/2026 11:28 am
TL;DR: ENISA’s SBOM Adoption State of Play 2026 surveyed 334 organisations and found that 74% have at least partially automated SBOM generation, yet only 7% say they have closed the gap between creating SBOMs and actually using them for vulnerability and licence management, according to Aikido’s summary of the report. The real problem is not producing inventory, but operationalising it across suppliers, formats, and remediation workflows.
Editorial analysis by NHI Mgmt Group, based on content published by Aikido: “SBOMs in 2026: Everyone's generating them, no one's using them”.
By the numbers:
- ENISA’s SBOM Adoption State of Play 2026 surveyed 334 organisations, according to Aikido.
- 74% have at least partially automated SBOM generation, according to Aikido.
- Only 7% say they have closed the gap between generating SBOMs and using them, according to Aikido.
Key questions
Q: Why do SBOM programmes fail even when generation is automated?
A: Automation solves only the creation step.
Q: When should teams prioritise SBOM consumption over better generation coverage?
A: Once generation is reliable enough to support consistent release processes, the next gain usually comes from improving intake, normalisation, and workflow integration.
Q: What are the signs that SBOM governance is not working well enough?
A: Common warning signs include missing dependencies, stale component inventories, release packages that do not match the recorded bill of materials, and no clear owner for updates when vulnerabilities are disclosed.
Practitioner guidance
- Define SBOM intake criteria for suppliers Require a common machine-readable format, minimum dependency depth, and usable component identifiers before supplier artefacts enter your workflow.
- Wire SBOMs into vulnerability triage Ensure component matching, false-positive handling, and remediation ownership are connected so that SBOMs trigger action rather than archive growth.
- Set data-quality gates for SBOM ingestion Reject SBOMs that lack complete component names, versions, or identifiers needed for vulnerability and licence analysis.
Bottom line: SBOM adoption is advancing at the generation stage, but many organisations still cannot turn that inventory into vulnerability or licence decisions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:44 pm
SBOM adoption is now a consumption problem, not a creation problem. The market has largely accepted that SBOMs should exist, but that does not mean they are being used to drive vulnerability or licence decisions. The governance failure is the gap between artefact production and operational action, which leaves security teams with inventory that does not change behaviour. Practitioners should measure SBOM maturity by whether it reduces decision latency, not by how many files are generated.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations handle supplier software when SBOMs are incomplete or absent?
A: Treat incomplete or missing SBOMs as an assurance gap, not a paperwork issue. Escalate supplier review, require usable machine-readable artefacts, and apply compensating controls such as tighter dependency monitoring and contract conditions until the supplier can provide evidence that your tools can actually consume.
👉 Read our full editorial: SBOM adoption is stalling at the point of use, not generation