Software Bill of Materials
A Software Bill of Materials (SBOM) is a machine-readable inventory of the components that ship inside a piece of software. This page says what SentriKat generates for its own releases, what it exports for yours, and what is not there yet.
Last updated: 2026-10-09
What we generate for SentriKat itself
- Format: a CycloneDX SBOM is generated for every SentriKat release, in JSON.
-
Generation: by the release
pipeline, with the
syftscanner. - Planned: SPDX output, detached signatures and a public download archive. They are on the roadmap, with no date until they are done.
Downloads
SBOMs are not published for download yet. Customers and prospects can ask for the current one by emailing [email protected]. We aim to reply within two business days, and we send a SHA-256 hash of the file with it so you can check what you received. If a file does not match its hash, do not use it and tell us.
SBOMs of your own fleet
From the Pro plan, SentriKat exports an SBOM for every host it inventories, in CycloneDX 1.5, SPDX 2.3 and STIX 2.1. This is a feature of the product, separate from the SBOM of SentriKat's own releases above.
Why SBOMs matter
Under the EU Cyber Resilience Act (Regulation (EU) 2024/2847), manufacturers of software and connected products must draw up an SBOM from 11 December 2027 and keep it in their technical documentation. Reporting of actively exploited vulnerabilities starts earlier, on 11 September 2026. The Regulation does not oblige a manufacturer to publish the SBOM: handing it to users is optional. A clean SBOM lets your security team:
- Trace every new CVE to the exact SentriKat version that contains the affected component
- Feed the SBOM into your own SCA pipeline or SIEM