CICI/CD News
Tag

#sbom

Tagged “sbom”

6 articles
Security & supply chain

Zero CVEs by default is a floor, not a moat

Docker is pitching its Hardened Images catalog as a way to make zero-CVE base images the default across your pipeline. That is a defensible floor. Treating a green scanner and a signed SBOM as the finish line is exactly how the last year of supply-chain incidents happened.

Aug 17, 2026 · Tomás VegaSecurity & supply chain

Omdia's 2026 supply-chain survey puts the annual-incident rate at 77 percent

A Docker-sponsored Omdia report pegs the twelve-month software supply-chain incident rate at 77 percent of surveyed organizations, with AI technology now ranked as the top supply-chain risk. The tool-effectiveness table rewards the sponsor's product category.

Aug 4, 2026 · Maya OkonkwoSecurity & supply chain

CISA rewrites the SBOM floor: hashes are required, and the scope now covers AI and SaaS

The 2026 Minimum Elements guidance from CISA replaces the 2021 NTIA baseline, adds required hash, license and generation-context fields to every SBOM, renames Supplier Name to Component Producer, and extends the floor to open-source software, AI systems and software-as-a-service. For platform teams the practical consequence is that SBOM work stops living inside the build step and starts spilling into vendor contracts and runtime re-validation.

Aug 2, 2026 · Maya OkonkwoSupply-chain security

The five-minute SBOM sniff test earns its keep

A quick, deliberate look at the bill of materials for a hardened image catches supply-chain trouble a CVE scanner will never flag. Bolt it into the pipeline, not the compliance report.

Jul 13, 2026 · Tomás VegaSecurity & supply chain

The SBOM you can trust is the one your build actually made

Docker published a guide arguing that SBOMs generated at build time beat post-build scans on completeness, accuracy and freshness. The distinction quietly changes what a CI pipeline is on the hook for.

Jul 8, 2026 · Tomás VegaSecurity & supply chain

SBOM attestation is becoming a default pipeline step

Generating and signing a software bill of materials at build time is shifting from compliance nice-to-have to standard CD hygiene. Here's the minimal viable setup.

Jun 12, 2026 · Tomás Vega