As a result, depending on the source of vulnerability information they use, companies might miss vulnerabilities entirely or postpone addressing them, thinking they are less critical to deal with than they actually are. And if a vulnerability’s score is changed after an application was assessed, it’s hard to tell how long it will take until it will be scanned again.

“Reducing persistent risk is possible by focusing on tools that help manage dependencies and apply real-time vulnerability detection,” the researchers wrote. “In fact, we found that projects using a Software Bill of Materials (SBOM) to manage OSS dependencies showed a 264-day reduction in time to fix compared to those that did not.”

The advance of SBOM standards and government regulations that strongly encourage them, have pushed an increasing number of open-source developers to adopt them. Unfortunately, the rate of adoption does not keep up with the rate of newly released components. Almost 7 million new open-source components were published in the past 12 months — of those, only 61,000 had SBOMs.