SBOMs were all the rage in the OT security community in 2022 and 2023. I wrote numerous articles on it. There were sessions on the topic at every OT security event, including S4. We even had a SBOM Challenge at S4x23 with six vendors creating SBOMs from a common set of OT cyber assets.
In 2026 … crickets.
I’m not sure we had a single session proposed in our S4x27 CFP on SBOMs, and I know nothing is on the agenda.
Why?
Were the solutions lacking? Were there much larger problems and risk reduction opportunities? Was there a lack of Log4j type of events? Were asset owners already struggling with known vulnerabilities and not eager to find a huge number more in components of their cyber assets? Probably all of the above and more.
I still believe the eventual market winner will be a SBOM middleman as pictured below and described in this article. When the next Log4j happens, and isn’t this more likely in our AI world, it would be much easier for asset owners to take their asset inventory and query one SBOM middleman to determine where the vulnerability is in their environment. Even better if the Schneider Electric, Rockwell Automation, Siemens et al also feed the middleman with the impact of the vulnerable component.
I’m not aware of any movement towards this business model. The best chance of it happening would be a Tofino-like event. Over 15 years ago a number of the largest oil companies told their suppliers that their upcoming RFPs were going to include a requirement for a Tofino industrial firewall integrated into the Purdue Level 1 environment, and some extended this into the OT / Safety interconnect. The result was a number of competitors working with Eric Byres and Tofino team to develop a Tofino module for their solution.
A similar result could occur if multiple large purchasers said if you are going to sell us something in 2027 and onward, you need to make your SBOMs available to this middleman for us to query when we need component information.
Waiting and watching.
