So What Is a CBOM, Actually?

A CBOM is a list of every piece of encryption a system uses, written down in enough detail that someone can actually evaluate it.

That’s the whole definition. Everything else is detail on top of it. Last post, we saw that a component list (an SBOM) can tell you a system uses a well-known encryption library, but stops short of telling you what that library is actually configured to do. A CBOM is what fills that gap. It doesn’t just name the library. It records the specific algorithm in use, the key size, the certificate behind it, and what data it’s protecting.

Rather than describe this abstractly, here’s what a single entry in a CBOM might contain, for one piece of a fairly ordinary system: the part that encrypts customer login sessions.

Notice what changed compared to a simple component list. It’s not “this system uses RSA” as a bare fact. It’s specifically where RSA is used, at what strength, protecting what, and whether that combination is still considered sound. A real system might have dozens or hundreds of entries like this one, covering every login, every database, every internal connection between services.

A fair question at this point: if SBOMs already exist, why didn’t someone just do the same thing for encryption years ago? The honest answer is that it’s a harder problem, for a specific reason.

Finding out which components a piece of software uses is largely a matter of reading a list the software itself provides, the same way checking a car’s parts list means reading the manufacturer’s documentation. Finding out how encryption is actually configured usually means looking directly at how the code is written and how the system behaves, because that configuration often isn’t written down anywhere on its own. Two systems can use the exact same encryption library and still be set up completely differently underneath it.

This is also why building the tools that generate a CBOM automatically is a genuinely active area of work right now, not a solved problem from a decade ago. The tooling exists and is improving quickly, but it’s still catching up to what SBOM tooling can already do reliably.

A component list tells you what’s present. A CBOM tells you whether what’s present is actually still safe.

That distinction is the whole reason this series exists. It’s also exactly why this is becoming urgent right now, which is where we’re headed next.