Software Bill of Materials: Companies, Startups & Research

Microsoft, GitHub, Google, Amazon, IBM and Red Hat are among the companies working on SBOM generation, dependency analysis or format support. Microsoft and GitHub connect generation to build and release workflows; Amazon supports software composition visibility through scanning; and Red Hat works on contextual SBOMs. Cisco also publishes SBOMs and contributes research on extending component inventories.

RunSafe Security, Binarly and Harbor Labs are the startups identified in the available data, each with a distinct focus. RunSafe develops compile-time SBOM generation for native code; Binarly analyzes firmware and binary artifacts; and Harbor Labs studies SBOM completeness and exposure in healthcare. These profiles show different technical niches rather than a ranked assessment of commercial prospects.

The data identifies 55 research organizations, including the University of Oxford, University of Sannio and Universita` Degli Studi Of Salerno. Oxford researchers investigate SBOM extensions for AI supply chains and tools for IoT component inventories. Researchers at Sannio and Salerno study adoption in open-source projects, vulnerability descriptions and methods for generating AI bills of materials.

Recorded funding data lists $46,953,694 in grants across 11 awards since 2020 and $32,850,758,066 across 9 funding rounds. The round data includes corporate and infrastructure financing entries, including deals associated with Siemens AG, Hitachi Ltd. and Wiz Co. These figures are therefore not a clean measure of investment dedicated specifically to SBOM technology.

CiscoTechnology Inc. leads the listed patent holders with 9 patents, followed by Siemens AG with 8. Patent activity is down: the data records 123 patents in the defined window and a 48.1% decline. By contrast, publications reached 119 in the last year and grew 26.6%, suggesting recent activity is more visible in research than in patent filings.

Recent developments include CISA’s July 2026 update to its minimum SBOM elements, a September 2026 study on runtime SBOM generation from memory, and an August 2026 paper on consumer-side reproducible verification. Insignary launched Clarity AIR in October 2026 to detect undeclared open-source and AI-written code. Together, these efforts address inventory coverage, integrity and the gap between declared and shipped software.

The five tracked approaches are manifest-based inventory, source-code identification, binary analysis, build-integrated creation, and formats and normalization. They differ in where component evidence comes from: manifests and source code describe declared or identifiable inputs, while binary analysis inspects compiled artifacts. Build integration captures information during production; formats and normalization make inventories easier to exchange, but do not by themselves ensure completeness.

The United States leads the country data with 73.1% of documents, followed by Germany at 17.1% and the United Kingdom at 14.7%. Japan, France and China are also among the countries with substantial activity. These figures reflect the distribution of documents in the dataset, not a direct measure of national adoption or market share.

SBOM applications include cloud and enterprise software, embedded systems and IoT, healthcare and medical devices, automotive and mobility, and government and critical infrastructure. Cloud and enterprise software has 880 documents, while embedded systems and IoT has 714. The data also shows recent activity in medical devices, where component inventories support cybersecurity documentation and risk management.