SBOMs Alone Can't Reveal the Scope of a Supply Chain Attack

A re­cent Shai-Hulud at­tack shows de­fen­ders need real-time vi­si­bi­lity into pro­duc­tion code and af­fec­ted ser­vi­ces to res­pond to supply chain com­pro­mi­ses.