--- title: "Asleep at the Wheel: Getting your SBOMs to pay attention... - Sanchit Sahay, Abhishek Reddypalle" url: https://daily.dev/posts/asleep-at-the-wheel-getting-your-sboms-to-pay-attention---sanchit-sahay-abhishek-reddypalle-eyr2ynedb source_url: https://www.youtube.com/watch?v=VYY3HnRtV6U type: video:youtube source: "PyCon US" published: 2026-07-02T18:29:17.421Z updated: 2026-07-02T20:17:05.714Z reading_time: 32 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Asleep at the Wheel: Getting your SBOMs to pay attention... - Sanchit Sahay, Abhishek Reddypalle **[PyCon US](https://daily.dev/sources/pyconus)** · 32 min read · 0 upvotes · 0 comments ## Summary Full talk title: "Asleep at the Wheel: Getting your SBOMs to pay attention to Python Builds" Between competing standards, tools, and compliance-checkboxes, developers are effectively told to “generate an SBOM” and move on. Security teams are told to trust this SBOM implicitly. When that SBOM is incomplete or inaccurate, the result is noise that creates a real security risk. Vulnerabilities can go undetected, where teams cannot confidently determine their exposure, and the compliance reviews/tools have to work with incomplete evidence of what actually happened. In the Python ecosystem, this problem is common. SBOMs rely solely on scanning environments and trusting declared dependencies. This model breaks often and silently, Python wheels for example include more dependencies than the metadata reveals - bundled libraries, vendored code, and build-time artifacts are often undetected. These missing components cause security teams to miss vulnerable components entirely and approve builds that violate organizational policy. This talk introduces SBOMit, an OpenSSF project which closes SBOM blind spots by generating SBOMs from build evidence rather than metadata alone. SBOMit consumes in-toto attestations and breaks the reliance on idealised assumptions and addresses the gaps of traditional SBOM tools. SBOMit asks the important question: “What did the build actually do?”. What commands it ran, files it accessed, and network calls it made. This approach lets us use CI attestations and provenance as a further source of truth. In this talk, we examine the gaps in today’s SBOM generation approaches and how they affect Python ecosystem. We walk through SBOMit’s architecture and how it provides a workflow to plug into your SBOM generation process. Finally, we’ll demonstrate how evidence-based SBOMs can be turned into enforceable CI policies for example preventing unexpected network access during builds or detecting unexplained files in final artifacts. SBOMit transforms your SBOM from a background actor to an active member of your supply-chain security toolkit. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Don’t just attend KubeCon \+ CloudNativeCon, Merge Forward your experience\!](https://daily.dev/posts/don-t-just-attend-kubecon-cloudnativecon-merge-forward-your-experience--l0rpp73x8) · CNCF · 0 upvotes · 0 comments - [Announcing H2 2026 KCDs](https://daily.dev/posts/announcing-h2-2026-kcds-m96goajm1) · CNCF · 1 upvotes · 0 comments - [Two months of Open Community Groups](https://daily.dev/posts/two-months-of-open-community-groups-asf52zhbs) · CNCF · 0 upvotes · 0 comments - [CNCF Unveils Schedule for KubeCon \+ CloudNativeCon Europe 2026](https://daily.dev/posts/cncf-unveils-schedule-for-kubecon-cloudnativecon-europe-2026-ikhcoa5cb) · CNCF · 2 upvotes · 0 comments - [CNCF Debuts KubeCon \+ CloudNativeCon Japan 2026 Schedule](https://daily.dev/posts/cncf-debuts-kubecon-cloudnativecon-japan-2026-schedule-xp5pyudub) · CNCF · 1 upvotes · 0 comments --- [View this post on daily.dev](https://daily.dev/posts/asleep-at-the-wheel-getting-your-sboms-to-pay-attention---sanchit-sahay-abhishek-reddypalle-eyr2ynedb)