SBOMs Alone Can't Reveal the Scope of a Supply Chain Attack

A recent Shai-Hulud attack demonstrates that software bills of materials (SBOMs) alone cannot reveal the full scope of a supply chain compromise. Defenders need real-time visibility into production code and affected services to respond effectively. The attack highlights the limitations of static SBOMs in dynamic environments, urging security teams to adopt continuous monitoring and runtime analysis.