01
11 July 2026 · 15 min read
SBOM explained: CycloneDX, SPDX and VEX in practice
Learn what an SBOM is, how CycloneDX and SPDX differ, where VEX fits, which minimum elements matter and how to build a trustworthy CI/CD process.
Topic · 4 articles
Software Supply Chain
All articles in the Software Supply Chain category on the Breachroad blog: analyses, guides and recommendations for businesses.
PUBLISHING STANDARD TECHNICAL RESEARCH AND ANALYSIS
- AuthorNamed technical practitioner
- BasisDate and primary sources
- PurposeConcrete defensive action
FIELD NOTES
TOPIC INDEX
Latest research
02
10 July 2026 · 9 min read
Patch the Planet: AI finds bugs in critical open source
AI found hundreds of potential flaws across major open-source projects, but triage, reproduction, safe patches and maintainer review remain essential.
03
1 July 2026 · 11 min read
Sigstore and SLSA: Proving Where Software Artifacts Come From
Signing without key management (Sigstore) and verifiable build provenance (SLSA) are the new supply chain defense. We translate Fulcio, Rekor, cosign and SLSA levels.
04
7 April 2026 · 18 min read
TeamPCP: how Trivy, KICS, LiteLLM and axios broke CI/CD trust
Technical analysis of the March 2026 supply-chain wave: hijacked Trivy and KICS tags, LiteLLM .pth execution, axios, CI/CD secrets and recovery.
BR / NEXT STEP
Prefer a specialist to check it for you?
Book a free consultation. We'll talk about your infrastructure and real priorities.
NDA · clear scope · direct communication