SBOMs Alone Can't Reveal the Scope of a Supply Chain Attack

A recent Shai-Hulud attack shows defenders need real-time visibility into production code and affected services to respond to supply chain compromises.