{"id":45213,"date":"2022-02-09T15:00:00","date_gmt":"2022-02-09T15:00:00","guid":{"rendered":"https:\/\/www.darkreading.com\/vulnerabilities-threats\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk"},"modified":"2022-02-09T15:00:00","modified_gmt":"2022-02-09T15:00:00","slug":"log4j-and-the-role-of-sboms-in-reducing-software-security-risk","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\/","title":{"rendered":"Log4j and the Role of SBOMs in Reducing Software Security Risk"},"content":{"rendered":"<p>Recent high-profile cybersecurity incidents such as the <a href=\"https:\/\/www.darkreading.com\/attacks-breaches\/what-we-know-and-don-t-know-so-far-about-the-supernova-solarwinds-attack\" target=\"_blank\" rel=\"noopener\">SolarWinds attack<\/a> and the <a href=\"https:\/\/www.darkreading.com\/attacks-breaches\/attackers-target-log4j-to-drop-ransomware-web-shells-backdoors\" target=\"_blank\" rel=\"noopener\">Apache Log4j vulnerability<\/a> have exposed the threats associated with the software supply chain. These can range from fairly simple exploits of known vulnerabilities to very sophisticated attacks, sponsored by <a href=\"https:\/\/cisomag.eccouncil.org\/solarwinds-hack-russia\/\" target=\"_blank\" rel=\"noopener\">nation-state actors<\/a>.<\/p>\n<p>The annual spending on enterprise software \u2014 also known as commercial off-the-shelf or COTS software \u2014 is now approaching <a href=\"https:\/\/www.saastr.com\/gartner-forecasts-enterprise-software-spending-increases-another-110-billion-in-2022\/\" target=\"_blank\" rel=\"noopener\">$600 billion with a growth rate of 11.5%<\/a>. Yet, given the magnitude of this investment, enterprises are spending a pittance on securing their software supply chain. This is what makes COTS software so dangerous \u2014 vulnerabilities can be &#8220;hidden&#8221; in open source components. However, there is a fix for this in a software bill of materials (SBOM).<\/p>\n<p><strong>Improving COTS Security Posture<br \/><\/strong>Traditionally, enterprises have trusted that software vendors are performing the necessary security due diligence, following accepted software engineering best practices, and disclosing the security practices for supporting their software. Customers, on the other hand, are left to investigate the security of the products they use through associations or user groups to share information about vendor risk and software security.<\/p>\n<p>These approaches are clearly not enough as shown by the Apache Log4j vulnerability. Despite the best intentions of software vendors, too many security vulnerabilities are lurking in open source components used to build COTS software. This represents a software security blind spot that the vendors themselves may not even know about. The key artifact needed to shed light on this blind spot is the SBOM. <\/p>\n<p>The SBOM is an inventory report of the software components that make up a software product <del>\u2014 j<\/del>ust like the labels on food products have a list of ingredients and nutritional information. <\/p>\n<p><strong>SBOMs and Vulnerability Detection<\/strong><br \/>Automating software supply chain security requires deep visibility into COTS applications. This includes having access to a BOM as well as detailed vulnerability information to truly understand the security risks to the organization. <\/p>\n<p>In addition, an SBOM often will include licensing information to help ensure compliance and reduce the risk that the software is released or consumed with unlicensed components. This license information can also help with forensics when investigating which version of an open source component is vulnerable to a security threat, as is the case with multiple releases of Apache Log4j.<\/p>\n<p><strong>Reducing Risk with SBOM Outputs <\/strong><br \/>There are several ways to use the data provided by an SBOM once a vulnerability is discovered. First, evaluate the results in terms of likelihood and impact. Likelihood is a determination of the probability of an attack succeeding using the discovered vulnerability. Impact should consider both the immediate damage and long-term impact to the company brand, bottom line, and customer experience. <\/p>\n<p>The quadrant approach below is one effective way to evaluate open source vulnerabilities found in COTS software. For example, software with some vulnerabilities, deemed unlikely to be exploited with low impact, could be approved for purchase, renewal, or maintenance contract by simply accepting the low risk level. Obviously, software with a high impact, high likelihood of attack vulnerabilities may need to be rejected. <\/p>\n<p>However, it is often not possible to simply reject software that is critical to the business. While using SBOM data in the COTS procurement process is a relatively new discipline, the assumption here is that both the customer and the vendor will act in good faith to improve the security of the product and reduce security risk over time. This assessment process can also be applied to currently deployed software. The illustration below shows a more nuanced decision workflow to follow once SBOM results are in-hand.<\/p>\n<figure>\n<picture><source type=\"image\/webp\" media=\"(max-width: 576px)\" srcset=\"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blta4f2ff3715ee3648\/61fd7348a75ecf3ad4b2c7e7\/SBOM.jpg?width=480&amp;quality=80&amp;format=webply&amp;disable=upscale\"><source type=\"image\/webp\" media=\"(max-width: 767px)\" srcset=\"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blta4f2ff3715ee3648\/61fd7348a75ecf3ad4b2c7e7\/SBOM.jpg?width=690&amp;quality=80&amp;format=webply&amp;disable=upscale\"><source type=\"image\/webp\" media=\"(min-width: 768px)\" srcset=\"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blta4f2ff3715ee3648\/61fd7348a75ecf3ad4b2c7e7\/SBOM.jpg?width=690&amp;quality=80&amp;format=webply&amp;disable=upscale\"><source type=\"image\/jpeg\" srcset=\"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blta4f2ff3715ee3648\/61fd7348a75ecf3ad4b2c7e7\/SBOM.jpg?width=690&amp;quality=80&amp;format=jpg&amp;disable=upscale\"><img decoding=\"async\" src=\"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blta4f2ff3715ee3648\/61fd7348a75ecf3ad4b2c7e7\/SBOM.jpg?width=690&amp;quality=80&amp;format=webply&amp;disable=upscale\" height=\"auto\">\n<\/picture><figcaption>Decision-making process for handling SBOM results. Source: Walter Capitani<\/figcaption><\/figure>\n<p><strong>-Approve\/Reject<\/strong><br \/>If the SBOM and vulnerability report indicate an unacceptable number of high severity vulnerabilities and the risk is too high, then the product should be rejected (top left above). Similarly, if the product exhibits only minor risk, then it can be accepted. <\/p>\n<p>&#8211;<strong>Conditionally Approve<\/strong><\/p>\n<p>In cases where a product introduces security issues (top right above) but the business needs for the software outweigh the risks, the product can be conditionally approved. In these cases, the security team can implement <a href=\"https:\/\/csrc.nist.gov\/glossary\/term\/compensating_security_control\" target=\"_blank\" rel=\"noopener\">compensating security controls<\/a> before deployment and monitor for potential threat activity targeting known vulnerabilities. Additionally, working with the vendor to remediate the risk is essential as they may be unaware of these vulnerabilities. Disclosure and cooperation are key.<\/p>\n<p><strong>-Conditionally Reject<br \/><\/strong>If the software product is business-critical but the security risk is just too high (bottom quadrants above), the product can be conditionally rejected. In such cases, the decision to proceed with deployment will depend on just how critical the software is to the business. In cases where security risk is too high, the organization can insist the issues be fixed before deployment or wait for a new version of the software that addresses the vulnerability. <\/p>\n<p>In the extreme case where the software is critical to the business and required for daily operations, the organization can negotiate financial, legal, and liability terms for its use with the vendor. <\/p>\n<p>The data provided by SBOMs can be used to improve software supply chain security from new product procurement to protecting deployed applications. In the case of COTS software, applying SBOM outputs to the risk quadrant model presented above can help organizations proactively reduce risk and eliminate threats in the software that runs their business.<\/p>\n<p>Read More <a href=\"https:\/\/www.darkreading.com\/vulnerabilities-threats\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Enterprises are spending a pittance on securing their software supply chain, which makes COTS software dangerous \u2014 vulnerabilities can be &#8220;hidden&#8221; in open source components.Read More <a href=\"https:\/\/www.darkreading.com\/vulnerabilities-threats\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\">HERE<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[151],"tags":[],"class_list":["post-45213","post","type-post","status-publish","format-standard","hentry","category-darkreading-ti"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Log4j and the Role of SBOMs in Reducing Software Security Risk 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Log4j and the Role of SBOMs in Reducing Software Security Risk 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2022-02-09T15:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blta4f2ff3715ee3648\/61fd7348a75ecf3ad4b2c7e7\/SBOM.jpg?width=690&amp;quality=80&amp;format=webply&amp;disable=upscale\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Log4j and the Role of SBOMs in Reducing Software Security Risk\",\"datePublished\":\"2022-02-09T15:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\\\/\"},\"wordCount\":893,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/blta4f2ff3715ee3648\\\/61fd7348a75ecf3ad4b2c7e7\\\/SBOM.jpg?width=690&amp;quality=80&amp;format=webply&amp;disable=upscale\",\"articleSection\":[\"DarkReading |TI\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\\\/\",\"name\":\"Log4j and the Role of SBOMs in Reducing Software Security Risk 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/blta4f2ff3715ee3648\\\/61fd7348a75ecf3ad4b2c7e7\\\/SBOM.jpg?width=690&amp;quality=80&amp;format=webply&amp;disable=upscale\",\"datePublished\":\"2022-02-09T15:00:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\\\/#primaryimage\",\"url\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/blta4f2ff3715ee3648\\\/61fd7348a75ecf3ad4b2c7e7\\\/SBOM.jpg?width=690&amp;quality=80&amp;format=webply&amp;disable=upscale\",\"contentUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/blta4f2ff3715ee3648\\\/61fd7348a75ecf3ad4b2c7e7\\\/SBOM.jpg?width=690&amp;quality=80&amp;format=webply&amp;disable=upscale\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Log4j and the Role of SBOMs in Reducing Software Security Risk\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Log4j and the Role of SBOMs in Reducing Software Security Risk 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\/","og_locale":"en_US","og_type":"article","og_title":"Log4j and the Role of SBOMs in Reducing Software Security Risk 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2022-02-09T15:00:00+00:00","og_image":[{"url":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blta4f2ff3715ee3648\/61fd7348a75ecf3ad4b2c7e7\/SBOM.jpg?width=690&amp;quality=80&amp;format=webply&amp;disable=upscale","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Log4j and the Role of SBOMs in Reducing Software Security Risk","datePublished":"2022-02-09T15:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\/"},"wordCount":893,"commentCount":0,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\/#primaryimage"},"thumbnailUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blta4f2ff3715ee3648\/61fd7348a75ecf3ad4b2c7e7\/SBOM.jpg?width=690&amp;quality=80&amp;format=webply&amp;disable=upscale","articleSection":["DarkReading |TI"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.threatshub.org\/blog\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\/","url":"https:\/\/www.threatshub.org\/blog\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\/","name":"Log4j and the Role of SBOMs in Reducing Software Security Risk 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\/#primaryimage"},"thumbnailUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blta4f2ff3715ee3648\/61fd7348a75ecf3ad4b2c7e7\/SBOM.jpg?width=690&amp;quality=80&amp;format=webply&amp;disable=upscale","datePublished":"2022-02-09T15:00:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\/#primaryimage","url":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blta4f2ff3715ee3648\/61fd7348a75ecf3ad4b2c7e7\/SBOM.jpg?width=690&amp;quality=80&amp;format=webply&amp;disable=upscale","contentUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blta4f2ff3715ee3648\/61fd7348a75ecf3ad4b2c7e7\/SBOM.jpg?width=690&amp;quality=80&amp;format=webply&amp;disable=upscale"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/log4j-and-the-role-of-sboms-in-reducing-software-security-risk\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Log4j and the Role of SBOMs in Reducing Software Security Risk"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/45213","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=45213"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/45213\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=45213"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=45213"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=45213"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}