Ninety-seven percent of organizations had at least one supply chain breach in 2025, up from 81% the year before (CybelAngel, synthesizing BlueVoyant and related industry data). That happened while TPRM budgets rose, teams added headcount, and questionnaires got longer.
The recurring mistake: treating two problems as one. Knowing your vendor is not the same as knowing your code.
Two Disciplines, Two Different Jobs
TPRM evaluates the vendor as a business. An SBOM evaluates the software artifact: every direct and transitive component you actually run. Both matter. Each, alone, leaves a blind spot.
| TPRM | SBOM | |
|---|---|---|
| Primary object | The vendor as an enterprise | The software artifact |
| Typical evidence | SOC 2, questionnaires, contracts | CycloneDX / SPDX component graph |
| Cadence | Annual or quarterly reviews | Can regenerate on every build |
| Answers | ”Is this company trustworthy?" | "What is inside this binary?” |
| Blind spot | Code that changed after the last review | Packages published between static scans |
Where TPRM Coverage Ends
Verizon DBIR 2025: third-party involvement in breaches jumped to about 30%, roughly double the prior year. SecurityScorecard: 35.5% of 1,000 analyzed breaches had a third-party origin; 41.4% of ransomware events started through vendor access.
IBM Cost of a Data Breach 2025: average cost of a third-party vendor / supply chain compromise is USD 4.91 million (global average: USD 4.44 million; 267 days to contain).
Where Static SBOM Coverage Runs Out
DigiCert adds the quality problem: 54% cite SBOM accuracy issues, 50% struggle to integrate with vulnerability tooling, and only 17% always sign SBOMs. Datadog: 87% of organizations run services with at least one known exploitable vulnerability; 42% of services depend on unmaintained libraries.
Generating an SBOM is routine. Acting on it is not.
The Vector Static Inventory Misses
CVE tracking matters. It still misses intentionally malicious packages that arrive with no CVE assigned: typosquatting, dependency confusion, hijacked maintainer accounts. Recent campaigns we analyzed (Shai-Hulud, express-plugin, LiteLLM) all exploit the gap between “an SBOM exists” and “someone is watching it between scans.”
A questionnaire never reads the package manifest. A one-shot SBOM never sees the transitive update published three weeks later.
Machine-Speed Attacks vs Human-Paced Defense
Automated builds pull third-party code continuously. Attackers automate payload delivery at the same tempo. Quarterly reviews cannot keep up.
Non-human identities make the mismatch worse. OWASP NHI research and related analyses put NHI-to-human ratios in cloud environments between roughly 45:1 and 100:1. Stolen CI tokens bypass people-centric SSO/MFA and look like legitimate automation. Questionnaires do not inventory GitHub Actions secrets. Static SBOMs do not revoke publish tokens.
Why Both Gaps Stop Being Optional
The EU Cyber Resilience Act makes live inventory a regulatory requirement, not a nice-to-have. For SBOM formats and NTIA minimum elements, see What Is an SBOM?.
What Actually Closes the Gap
This is not “SBOM vs TPRM.” It is two programs with complementary blind spots. Closing the code-side gap needs three continuous controls.
- Continuous inventory. Regenerate SBOMs on every build. Catch packages that appear between annual reviews.
- Reachability and prioritization. Knowing a CVE is in the tree is not the same as knowing your code calls it. Prioritize the subset of the 87% that must move this week.
- Remediation in engineer workflows. Inventory in a compliance folder stalls. Inventory in Jira, GitHub, Linear, or Slack gets fixed.
Keep TPRM for vendor access and contractual risk. Add continuous SBOM operations for the code path.
If your program is still in the 78% started / 9% mature band, or among the 75% generating SBOMs that nobody acts on, see how Centriole closes that gap.
Sources
- CybelAngel, Every Vendor Is a Vector: 2026 Supply Chain Risk Report (synthesizing BlueVoyant State of Supply Chain Defense 2025 and related industry data)
- Verizon, 2025 Data Breach Investigations Report (DBIR)
- SecurityScorecard, 2025 Global Third-Party Breach Report
- IBM, Cost of a Data Breach Report 2025 (Ponemon Institute; third-party vendor and supply chain compromise averaged USD 4.91 million)
- ENISA, SBOM Adoption State of Play 2026
- Cloudsmith, 2026 Artifact Management Enforcement Gap Report
- DigiCert, 2026 State of Software Supply Chain Security
- Datadog, State of DevSecOps / DevOps
- Prevalent, 2025 Third-Party Risk Management Study
- European Union, Cyber Resilience Act (Regulation EU 2024/2847)
- OWASP Non-Human Identities Project
- Sonatype, State of the Software Supply Chain Report (broader ecosystem context on dependency risk and automated ingestion)