How SBOMs and Engineering Discipline Can Help You Avoid Trivy’s Compromise

Viktor Peterson, part of the CISA task force working on SBOM blueprints and co-founder of sbomify, explores the shifting landscape of software supply chain security as the EU's Cyber Resilience Act (CRA) comes into force, a "GDPR moment" for the industry. Beyond mere compliance, Peterson argues that SBOMs provide significant operational value as tools for automated security audits and license management, provided they are generated using ecosystem-specific tools rather than generic scanners. He also points to providing critical security insights into the risks of weaponised code, citing recent incidents where security tools themselves became attack vectors, and emphasises the need for vendor-neutral discovery mechanisms like the Transparency Exchange API (TEA) to secure the software lifecycle. Read a transcript of this interview:

You can listen to How SBOMs and Engineering Discipline Can Help You Avoid Trivy’s Compromise online on Radio and Podcast. Open the player on this page to stream the available audio.

How SBOMs and Engineering Discipline Can Help You Avoid Trivy’s Compromise is an episode from The InfoQ Podcast by InfoQ.

This episode is 00:37:43 long.

This episode was published on Apr 13, 2026.

Yes. Use the heart button on the episode page to add it to your favorite episodes list.

Yes. This page shows related episodes from The InfoQ Podcast when more episodes are available from the podcast feed.