Software Security
Most Software Bills of Materials Lack Dependency Graph Data, Study Finds
A survey of nearly 80,000 real-world SBOMs reveals that over half declare no dependencies at all, undermining vulnerability triage and impact analysis.
Researchers have conducted the first major empirical analysis of how well Software Bills of Materials (SBOMs) capture software dependency relationships in practice. Examining 78,612 real-world SBOM files, they discovered that a large majority of these files fall short of providing the structured dependency data that security tools rely on.
The Three-Tier Problem#
The study reveals the SBOM population splits into starkly different tiers. More than half—52.9%—of all SBOMs declare no dependency edges whatsoever, violating the U.S. National Telecommunications and Information Administration's (NTIA) minimum standard for what an SBOM should contain. Another 8.8% include some dependency declarations but leave the vast majority of listed components isolated from one another. In this "degenerate" category, when SBOMs contained 50 or more components, a median of 93% remained orphaned—unconnected in the dependency graph. The remaining 38.3% of SBOMs form reasonably connected graphs.
The researchers found particularly poor dependency coverage in container-image SBOMs generated by the Syft tool, which showed 91–98% orphan rates across eleven examples examined.
Who's Responsible#
Interestingly, the presence or absence of dependency edges correlates almost entirely with the tool that generated the SBOM, not the actual software being described. Different SBOM generators show no-edge rates ranging from 0% to 100%, suggesting the problem stems from tool limitations rather than the inherent complexity of documenting a given piece of software.
CycloneDX, one major SBOM specification, includes a formal mechanism to indicate incomplete dependency graphs through "compositions." However, only 0.10% of CycloneDX documents use this feature.
Why It Matters for Security#
Many vulnerability-management systems assume that if no path exists between a vulnerable component and the application entry point, that component is unreachable and safe. The incomplete nature of most SBOMs makes this reasoning unsound: the absence of an edge often signals missing data rather than actual unreachability.
The researchers demonstrated that a practical fix—deploying a "degeneracy detector" to flag SBOMs with incomplete graphs and marking flagged components as "unknown" severity rather than safe—improved vulnerability recall from 60% to 95% in testing, without causing false-alarm fatigue. In a live end-to-end run, the approach achieved 95.7% recall.