Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11The SolarWinds Orion compromise showed that software can be altered in the build process even when malicious code is absent from the source-code repository. A software bill of materials (SBOM) can help an organization identify components and respond to vulnerabilities, but it does not prove that a build or release was trustworthy. Reducing supply-chain risk takes both component visibility and controls over how software is built, verified, distributed, and maintained.
How the SolarWinds Orion compromise worked
SolarWinds said its investigation found SUNBURST in Orion builds released between March and June 2020. In its 2020 Form 10-K, the company said the malicious code was inserted during a compromise of the Orion build system and was not present in the source-code repository. If present and activated, the code could potentially allow an attacker to compromise the server running Orion.
That account describes a compromise of the process that turned source code into distributed software. Reviewing a source repository or listing the software’s components would not, by itself, establish that the build system or resulting release had remained intact.
Why the incident counts differ
The figures reported by SolarWinds and later alleged by the U.S. Securities and Exchange Commission describe different things. They are not interchangeable measures of installations, exploitation, or successful follow-on attacks.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →#1 Best Overall
| Measure | Reported figure | Attribution and meaning |
|---|---|---|
| Customers who could have installed an affected version | Fewer than 18,000 | SolarWinds’ estimate in its 2020 Form 10-K; the company said it could not determine precisely how many customers installed an affected version or were compromised. |
| Customers who received three affected builds | Nearly 18,000 | Allegation in the SEC’s 2023 civil complaint; this is a distribution claim, not a count of confirmed compromises. |
| Organizations subject to secondary attacks | Approximately 100 | Allegation in the SEC’s 2023 civil complaint; a distinct measure from the number of customers receiving affected builds. |
| Publicly traded companies and other regulated entities among impacted customers | More than 1,500 | Allegation in the SEC’s 2023 civil complaint. |
In October 2023, the SEC announced charges against SolarWinds and its CISO, Timothy G. Brown, alleging fraud and internal-control failures related to alleged misstatements about cybersecurity practices and known risks. Those claims are allegations in the SEC release and complaint, not findings established by the figures above.
What an SBOM tells you
NIST reproduces the definition in Executive Order 14028 of an SBOM as a “formal record containing the details and supply chain relationships of various components used in building software.” In practical terms, it is a structured inventory of software components and their relationships—a little like an ingredients list, though its usefulness depends on the quality and currency of the information.
When an organization can connect component identities and versions in an SBOM to vulnerability information and its own software inventory, it can more quickly identify where a newly disclosed issue may matter. That visibility can inform investigation and remediation; it does not, on its own, determine whether a component is exploitable in a particular deployment.
Formats and program capabilities
NIST’s SBOM guidance identifies SPDX, CycloneDX, and SWID as standard formats. It recommends capabilities that make SBOMs usable across suppliers and internal teams:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute- Machine-readable SBOMs that conform to a recognized format and include minimum data elements.
- Enterprise cataloging so teams can connect software in use with component records.
- Supplier-maintained repositories and ways to share SBOMs with customers.
- Integration with vulnerability detection and alerting so component records can inform response work.
- Where feasible, improving SBOM information or using binary decomposition to understand legacy software.
These are recommended capabilities, not guarantees that a particular SBOM is complete, accurate, current, or evidence of a secure build. CISA’s recommended practices for SBOM consumption likewise treat obtaining a document as only part of the work: organizations need to ingest it, correlate its information with vulnerabilities and risk, and decide what mitigations are appropriate. CISA cites SolarWinds and Log4j as examples of supply-chain weaknesses.
What an SBOM cannot establish
An SBOM can help answer, “What components and versions does this software record identify?” It cannot by itself establish that the inventory is exhaustive, that every entry is correct, that a component is exploitable in a given environment, or that the build pipeline was uncompromised. SolarWinds described malicious code entering during a build-system compromise, illustrating why a component inventory and evidence about how an artifact was produced answer different questions.
For that reason, publishing an SBOM would not necessarily have prevented SUNBURST. The value of the inventory is in improving visibility and supporting response; confidence in the build and release process depends on additional safeguards.
Build a broader supply-chain risk program
NIST’s evolving standards and practices frame software supply-chain security as a set of foundational, sustaining, and enhancing capabilities. Organizations can tailor priorities to their maturity and practical constraints; the guidance is a framework for federal buyers to adapt, not a universal mandate for every organization.
Recommended Free Tools
Alongside SBOM work, NIST’s practice areas include enhanced supplier-risk assessment, controls for open-source software, software verification, and vulnerability management. A practical program should connect those activities rather than treating an SBOM as a standalone compliance artifact.
- Control build-environment access: Assess who and what can change build systems, and how access is managed.
- Verify software and artifacts: Establish checks that help determine whether software and releases are the expected ones.
- Track provenance: Preserve useful information about where software came from and how it was produced.
- Operate vulnerability management: Connect component information to detection, prioritization, alerting, and remediation workflows.
- Assess suppliers and open-source dependencies: Include both in the organization’s wider software-risk process.
How to evaluate an SBOM or supply-chain security program
The following comparison criteria synthesize the published guidance; they are not an official scoring rubric or a ranking of products. Use them to assess whether a program can support the work your organization actually needs to do:
- Coverage: Does it address both supplier-provided and internally developed software, and can teams use the resulting records?
- Interoperability: Can it generate and ingest machine-readable records in formats such as SPDX, CycloneDX, or SWID?
- Component identification: Does it identify components and versions clearly, and expose missing or uncertain dependency information?
- Vulnerability workflow: Can component data be correlated with vulnerability information, prioritized, routed as alerts, and connected to remediation?
- Build assurance: Does the wider program address provenance, artifact integrity, build-environment controls, and software verification—not only inventory?
- Maintenance and sharing: Are records kept current, stored accessibly, and shared in a way that fits supplier relationships, procurement, and asset inventories?
What changed in the 2026 minimum-elements update
On July 29, 2026, CISA announced that it, the NSA, the FBI, and international partners had released “2026 Minimum Elements for a Software Bill of Materials (SBOM).” The announcement says the update builds on NTIA’s 2021 minimum elements and reflects lessons and tooling advances as SBOM generation, sharing, consumption, and analysis have grown.
The announcement information available here does not establish a detailed list of changed fields or a comparison with the earlier elements. It therefore does not support claims that particular fields were added or that older SBOMs are invalid. Organizations adopting the update should consult the released elements themselves to determine what changed and how it applies to their requirements.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
