SBOM Adoption in 2026: High Generation, Low Utilization

• •78% of organizations have begun generating SBOMs due to the EU Cyber Resilience Act.
• •58% of organizations report challenges with vulnerability matching related to SBOMs.
• •Only 29% of organizations receive complete SBOMs from their suppliers.

ENISA's SBOM Adoption State of Play 2026 report reveals that while 78% of organizations have started generating Software Bills of Materials (SBOMs), actual usage remains low. The EU Cyber Resilience Act (CRA) is a significant driver, with 43% of organizations citing it as a major influence on their SBOM investments. However, challenges persist, as 58% of organizations struggle with vulnerability matching and 60% face data quality issues. Only 29% of organizations receive comprehensive SBOMs from suppliers, highlighting a critical gap in supply chain transparency. The report indicates that many organizations are at risk of not meeting the CRA's requirements by December 2027. Aikido Security offers solutions to enhance SBOM integration into vulnerability management workflows.