Every application depends on cryptography. Encryption, certificates, keys, and protocols quietly protect your data and your users. Yet most organizations can't say exactly which algorithms their software uses, where they live, or how strong they are.
MetaDefender Software Supply Chain 4.2.0 changes that with CBOM (Cryptographic Bill of Materials): a complete, automated inventory of the cryptographic assets across your code, containers, and artifacts, with a quantum-safety verdict for every job, file, and repository and a dashboard that summarizes them all. It joins the platform’s existing SBOM (Software Bill of Materials) capabilities, giving you visibility into both what your software is made of and the cryptography it relies on.
What Is CBOM?
CBOM is a structured record of every cryptographic asset in your software, including:
- Algorithms and cipher suites
- Certificates and their validity
- Keys and key lengths
- Protocols and their versions
- Cryptographic libraries and where they are used
Instead of hunting through repositories and images by hand, you get one clear view of what's there, generated automatically as part of your software supply chain security workflow.
How CBOM Works
CBOM runs inside the scans you already use, so there's no separate tool to deploy or manage:
- Scan: Your code, containers, and artifacts are checked for cryptographic assets
- Inventory: Every algorithm, certificate, key, and protocol is compiled into one CBOM
- Review: Export the results to share with auditors, customers, and your own teams
Why CBOM Matters Now
Post-quantum readiness starts with visibility. Organizations are preparing to move away from algorithms that quantum computing will eventually weaken. You can't plan that migration without knowing where those algorithms are. CBOM gives you the starting point.
Compliance expects proof. Customers, auditors, and regulators increasingly ask for evidence of cryptographic hygiene, and frameworks like PCI DSS, NIST post-quantum standards, CNSA 2.0, DORA, and NIS2 all point toward knowing which cryptography you use. CBOM turns that answer into a report instead of a research project.
Weak cryptography hides in dependencies. Deprecated ciphers, short keys, and outdated protocols often come from third-party components your team never wrote. CBOM brings them into the open so you can prioritize and fix them.
More in 4.2.0
CBOM leads the release, but 4.2.0 also makes the rest of your workflow faster:
- Copy Remediation: Available for GitHub and Harbor, so fixes reach the repositories your teams already use
- Event-based scans: Harbor and Nexus can trigger a scan automatically the moment an artifact is added or updated
Commencer
Know what's protecting your software, and what isn't. Update to MetaDefender Software Supply Chain 4.2.0 and generate your first CBOM today.
FAQ
What is a CBOM?
A CBOM (Cryptographic Bill of Materials) is a structured inventory of the cryptography in your software, including algorithms, libraries, certificates, protocols, and key material.
Does CBOM require a separate tool?
No. CBOM runs inside the scans you already use in MetaDefender Software Supply Chain 4.2.0.
Why does post-quantum readiness start with a CBOM?
Migrating away from vulnerable algorithms means knowing which ones you use and where. A CBOM gives you that map.
