SBOM Use Case: Technical Debt

During software development, functional requirements are frequently addressed by adding components that together provide the required functionality. Over the whole lifecycle, this can add up. Ensuring that all these dependencies, as well as their transitive dependencies, are up to date is not only a question of Security Management but also of handling technical debt. Deprecated dependencies may contain bugs that have since been fixed, or lack optimizations that are present in newer versions. Each such instance adds technical debt that will eventually incur costs due to crashes or inefficiencies. SBOMs can help address this: the list of components and their versions can be compared against the most recent releases to identify minor and major version changes, which can then be used to prioritize updates and pay down the accumulated debt.

Example

The software has been developed for years. Every year, new components have been added, but due to the pace of development there was never a focus on updating components unless required. An analysis of the SBOM reveals that several of the components used are available in newer versions. The required updates are prioritized based on the version difference, and some components are replaced entirely because they are no longer maintained and better-featured forks are available. In the end, the software runs faster because the updated components include optimizations not present in the old versions.