SBOMs and supply‑chain basics (Syft/Grype) — Security Pitfalls & Fixes — Practical Guide (Feb 27, 2026)
SBOMs and supply‑chain basics (Syft/Grype) — Security Pitfalls & Fixes
Level: Intermediate
As of February 27, 2026
Introduction
Software Bill of Materials (SBOMs) have become fundamental in improving supply-chain security across modern software development workflows. They are detailed inventories of all components, libraries and dependencies that comprise a software artefact or container image. This transparency helps teams identify vulnerabilities, maintain compliance, and manage licensing risks.
Two prominent open-source tools in this space are Syft and Grype, developed by Anchore. Syft generates SBOMs while Grype scans them for vulnerabilities. Both continue evolving steadily with Syft stable from v0.70+ and Grype stable v0.77+ as of early 2026.
Prerequisites
- Familiarity with container images or local software packages
- Basic command-line proficiency (Linux/macOS/Windows WSL)
- Installed Syft (v0.70+ recommended) and Grype (v0.77+ recommended)
- Internet connection for vulnerability database and package metadata updates
- Optional: Docker or Podman to work with container images
Hands-on Steps
1. Generate an SBOM with Syft
Syft supports a wide range of sources—for example, container images, directories, and various package manager formats:
# Create an SBOM for a Docker image (e.g., alpine latest)
syft alpine:latest -o spdx-json > alpine-sbom.spdx.json
# Generate an SPDX SBOM for a local directory
syft dir:/path/to/app -o spdx-json > app-sbom.spdx.json
Syft also supports SPDX, CycloneDX, and Syft’s own JSON formats. Choose “-o ” accordingly and prefer standard formats (SPDX or CycloneDX) for interoperability.
2. Scan SBOMs or artefacts with Grype
Grype reads SBOMs or inspects images/packages directly to identify known vulnerabilities by referencing CVE databases:
# Scan an SBOM file
grype sbom:alpine-sbom.spdx.json
# Directly scan a Docker image without explicit SBOM generation
grype alpine:latest
Grype’s vulnerability database updates regularly. Use grype db update periodically for fresh data.
3. Integrate into CI/CD pipelines
You can embed Syft and Grype commands into pipeline scripts, using exit codes and severity thresholds to block deployments on critical issues.
Common Pitfalls
1. Outdated Vuln Database or SBOM Formats
Failing to regularly update Grype’s vulnerability database causes missed detections. Likewise, mixing SBOM formats without verification reduces tooling effectiveness. Stick to stable Syft formats (SPDX and CycloneDX) for broad compatibility.
2. Blind Trust in SBOM Completeness
Not all package managers or image layers are fully parsed by Syft, especially if you have proprietary or niche components. Always review SBOM content for completeness and consider augmenting with custom scanners if needed.
3. Overlooking Remediation Priorities
Finding hundreds of vulnerabilities can overwhelm teams. Prioritise fixes using severity metrics (CVSS) and exploitability. Grype outputs include advisory URLs; link these to your triage processes for actionable insights.
4. Using Preview or Experimental Features in Production
Syft and Grype occasionally introduce preview features (marked in release notes). Avoid reliance on these unless you can tolerate potential instability or breaking changes.
Validation
After generating SBOMs and scanning, validation is crucial for verifying integrity and actionable results.
Check SBOM Structure and Completeness
Use SPDX or CycloneDX validator tools—such as CycloneDX CLI or SPDX online validator—to confirm schema conformance.
Review Grype Vulnerability Reports
Grype outputs structured reports in formats like JSON, table, or templates. Automate extraction of critical vulnerabilities and verify that they correspond with known issues in your SBOM.
# Example JSON output for vulnerability enumeration
grype alpine:latest -o json > vuln-report.json
# Check for high severity issues using jq or similar tools
jq '.matches[] | select(.vulnerability.severity=="Critical")' vuln-report.json
Checklist / TL;DR
- Install Syft (v0.70+) and Grype (v0.77+) and keep them updated
- Generate SBOMs in SPDX or CycloneDX for best tool support
- Regularly update vulnerability databases with
grype db update - Validate SBOM schemas and review output completeness
- Prioritise vulnerabilities based on severity and exploitability
- Embed SBOM generation and scanning in CI/CD with clear fail/pass criteria
- Avoid experimental features unless explicitly needed and tested
When to choose Syft + Grype vs Alternatives
Syft & Grype: Ideal for open source, highly customizable, CLI-friendly workflows, with strong container and multi-format support.
Alternatives like OWASP Dependency‑Check, Snyk, or Trivy: May offer richer UI, commercial support, integration with cloud-native pipelines or extended runtime scanning.
Syft/Grype excel in transparency and open development but depending on your workflow and organisational requirements, combining tools can be beneficial.