What a CBOM Is — and Why an SBOM Won't Answer the Quantum Question

Post-quantum cryptography (PQC) migration requires a detailed inventory of cryptographic assets to replace vulnerable algorithms like RSA and ECC. While Software Bills of Materials (SBOMs) track components and dependencies, they lack the granularity to identify specific algorithms, key sizes, or certificates embedded within those components. This gap necessitates the Cryptography Bill of Materials (CBOM), a machine-readable standard ratified via OWASP CycloneDX 1.6 and ECMA-424, which maps cryptographic assets to the software components that provide them.
The challenge of discovery is acute because much of this cryptography resides in third-party, closed-source software and compiled binaries where source code is unavailable. While NIST has finalized the first three PQC standards (FIPS 203, 204, and 205), timelines for deprecating quantum-vulnerable algorithms range from 2030 to 2035. The immediate priority for organizations is establishing a baseline CBOM to surface existing vulnerabilities, as adversaries may currently be capturing encrypted data for future decryption.

* A Cryptography Bill of Materials (CBOM) is a machine-readable inventory of cryptographic assets and their relationships to software components.
* OWASP CycloneDX 1.6 standardized the CBOM in April 2024, and it was ratified as ECMA-424 two months later.
* CycloneDX 1.7, released in October 2025, added standardized lists of algorithm families and elliptic curves.
* NIST finalized FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) in August 2024.
* NIST IR 8547 proposes deprecating RSA and ECC key sizes after 2030 and disallowing quantum-vulnerable algorithms after 2035.
* The UK National Cyber Security Centre (NCSC) targets discovery completion by 2028 and full transition by 2035.
* A 2025 Utimaco survey of over 200 organizations found 20% have begun PQC migration and 34% plan to start within one to three years.
* CBOMs record assets including algorithms, certificates, protocols, and private, public, and secret keys.
* "Harvest now, decrypt later" is a tactic where encrypted data is collected today to be decrypted by future quantum computers.
* CISA, the NSA, and NIST issued a quantum-readiness factsheet in 2023 recommending automated discovery.

The strongest version of this narrative is a technical call to action: the shift to PQC is an inevitable security requirement, and current visibility tools (SBOMs) are mathematically insufficient for the task. It correctly identifies a critical bottleneck—discovery in closed-source binaries—and proposes a standardized solution (CBOM) to move from "trust" (vendor attestations) to "evidence" (binary analysis).
However, the narrative structure follows a classic vendor-driven conversion funnel. It creates a sense of urgency through the "harvest now, decrypt later" threat and regulatory deadlines, then presents a technical gap that can only be solved by high-fidelity binary analysis—the exact service provided by the sponsoring vendor's Spectra suite. By framing the CBOM as the only way to avoid "guesswork," the narrative transforms a standardized data format into a product requirement.
Patterns detected: ARC-0021 Authority Game, ARC-0012 Fear Appeal
The driving paradigm is "Security through Total Visibility." It assumes that the only path to resilience is an exhaustive, machine-readable inventory. This echoes the historical shift toward SBOMs for supply chain security, moving the burden of proof from the vendor to the consumer's analysis tools. The benefit accrues to security tool vendors and high-compliance organizations, while the cost is a heightened reliance on proprietary scanning technologies to validate third-party software.
Bridge Questions:
1. If CBOMs become mandatory, how will vendors protect proprietary intellectual property within their binaries while allowing for deep cryptographic inspection?
2. Can an organization effectively manage PQC risk through architectural isolation or "crypto-agility" without requiring a perfect inventory of every legacy primitive?
Counterstrike Scan: An influence campaign would use a "fear-to-solution" pipeline: amplify a futuristic threat (Quantum Apocalypse), cite authoritative bodies (NIST/CISA) to validate the fear, and then position a specific proprietary tool as the only viable bridge to safety. The structural alignment here is high, as the content blends legitimate regulatory guidance with a direct commercial call to action.