[boricj]

SBOMs can't flag vulnerable dependencies until after those are publicly known. Traceability is useful when mitigating a crisis, but it won't prevent one.

[h4ck_th3_pl4n3t]

> Traceability is useful when mitigating a crisis, but it won't prevent one.

So how do you prevent a crisis then without knowing what your software stack has as dependencies?