Global Bank Partners with AccuKnox for SBOM and Supply Chain Security

What the Bank Actually Bought

The bank did not buy a standard file source generator. The bank selected AccuKnox for supply chain security. The deciding factor was lifecycle coverage, not just BOM generation. The evaluation scoping and criteria was what happens after a BOM exists.

That capability is what most SBOM programs lack. A tool that emits a clean CycloneDX file and stops tells you what shipped. It does not tell you what to do about the findings. The bank’s requirement was continuous: hold visibility of every component across every application, refresh the record when software changes, ingest and validate the BOMs its own vendors send in, and block a workload that fails policy before it deploys. Vendor BOM ingestion is the capability most institutions have no process for.

A generated SBOM in the AccuKnox platform, carrying component, version, and supplier fields per record.

The Regulations Converged on the Same Requirement

An SBOM is no longer a US federal ask. Four instruments, on two continents, now expect one.

The NTIA minimum elements set the practical bar every one of these leans on: each component needs a supplier, a name, a version, a unique identifier, its dependency relationships, the author of the BOM data, and a timestamp. The EU CRA, Regulation (EU) 2024/2847, entered into force in December 2024, with reporting obligations from September 2026 and the main manufacturer obligations from December 2027. A bank building software or buying it in the EU is now in scope on a fixed clock. CISA’s 2025 refresh of the minimum elements shows the bar is still rising, not settling.

A real CycloneDX SBOM, with the wider xBOM set (CBOM, HBOM, MBOM, SBOM) in the sidebar.
Source: CycloneDX bom-examples, GitHub.

A vulnerable component is often reached through transitive dependencies, not a direct one. Source: Semgrep.

The Threat Behind the Mandates is Measurable

Regulators are reacting to a real trend. Sonatype’s 2026 State of the Software Supply Chain identified more than 454,600 new malicious packages in 2025 alone, pushing the cumulative total past 1.233 million across npm, PyPI, Maven Central, NuGet, and Hugging Face. Gartner predicted that by 2025, 45% of organisations worldwide would have experienced an attack on their software supply chain, a threefold rise from 2021.

For a bank, the exposure is rarely a direct dependency the team chose. It arrives through the libraries those libraries pull in, the transitive layer nobody reviewed. That is exactly why the standards require full dependency graphs rather than a flat component list.

SBOM is Table Stakes, xBOM is the Real Scope

The bank’s form treated software as the starting point, not the whole job. AccuKnox generates SBOM automatically and extends the same toolchain to the wider family: CBOM for cryptography, AI-BOM for models and datasets, and HBOM for hardware. A 2026 supply chain program that covers only software is one audit cycle away from being reopened. The xBOM approach unifies the set under one inventory.

Every record comes out in both SPDX and CycloneDX. SPDX is an international standard, ISO/IEC 5962:2021, stewarded through the Linux Foundation, and CycloneDX is stewarded by OWASP. Emitting both means the bank can hand a regulator or a customer whichever format the request names, without regenerating anything.

A BOM in a Directory Changes Nothing, Enforcement Does

Most programs stop at generation. Risk starts there. AccuKnox carries the record forward into the pipeline. Artefacts from the repository, container images, and packages feed a signing step that produces signed releases. The platform then runs BOM analysis, license verification, and risk prioritisation, mapping CVEs onto components by severity and exploitability.

Two controls turn the inventory into a gate. An admission controller checks the BOM before a workload deploys. A workload with no BOM or a disallowed license never reaches the cluster. Runtime enforcement then holds the deployed state against the recorded BOM, catching drift after deployment. That chain is also what moves a build platform up the SLSA levels, from signed provenance toward hermetic builds and full pipeline security.

License risk rides the same graph. An open-source component that quietly moved from a permissive license to a commercial one surfaced here, at build time, rather than in a legal review two years later.

Buy for the Lifecycle, not the File

The global bank’s decision is a preview of the market. The regulations have converged, the threat data is unambiguous, and the file itself is a commodity. What separates a compliant program from a checkbox is whether the BOM drives ingestion, dependency analysis, admission control, and runtime enforcement, across software, cryptography, AI, and hardware. Buy for the lifecycle. The audit evidence follows from the enforcement.

See the Full xBOM Coverage in One Place

This overview walks through generating SBOM, HBOM, CBOM, QBOM, and AI-BOM from one toolchain.

FAQ