In a pivotal development set to reshape software governance and compliance landscapes, CAST, a global leader in software intelligence, has introduced the CAST SBOM Manager. This groundbreaking freemium offering emerges as a critical solution for enterprises grappling with the increasing demand for accurate Software Bill of Materials (SBOMs) from regulatory bodies and stakeholders alike.

Founded in 1990 with headquarters in New York, USA and Paris, France, CAST provides intelligence about the inner workings of custom-built software, including migration & optimization for cloud, technical debt reduction, portfolio open source risk control, automating SBOM creation, and enhancing the quality grades of the software through its product portfolio. As a leading provider of SCA capabilities through CAST Highlight, the company has a range of capabilities that enable users who rely on third-party and open-source components to efficiently perform vulnerability management, license compliance, risk assessment, enhanced transparency, support for DevOps practices, and continuous improvement.

By understanding the volatile security landscape, the rising importance of SBOMs in the western hemisphere governance strata, and with the aim to empower organizations to maintain accurate SBOMs, the company has announced CAST SBOM Manager that automates & simplifies the creation & handling of SBOM especially for organizations that supply software especially regulated device manufacturers with embedded software, government vendors, and independent software vendors.    

In the Summer 2024 Release by CAST, the company has announced the major release of CAST Highlight for the application portfolio:   

CAST SBOM Manager: A new extension that performs the detection of Open Source dependencies & related risks directly from scanning source code and allows the creation & maintenance of SBOM metadata.

SPDX 2.3 Export: Facilitates compliant support for exporting SBOMs in SPDX 2.3 format.

GitLab CI Scan Integration: Provision of extension for CI Yaml template for GitLab’s CI integration to run CAST Highlight scans on GitLab-hosted repositories for accelerating the implementation for applications hosted in GitLab.

COBOL Support for Green Insights: New support for Green Impact and CO2 Emission Estimates through enhanced insights for COBOL applications.

Microsoft Power BI Template: Simplified creation of custom dashboards through utilization of Microsoft Power BI Template that integrates insights from CAST Highlight into custom Power BI Dashboard and enables users to create executive level & organizational application portfolio overview dashboards.

GitHub Security Advisories Support: New Support for GitHub Security Advisories to improve OSS and 3^rd party security risk reporting coverage.  

Available Custom Dashboard Widgets: CAST Highlight facilitates most of its metrics & indicators that can be used in custom dashboards along with:

• Metric Tiles: Visualization of the aggregated score of the selected metric
• Description Panels: Facilitate the addition of text explanation to any other widget
• Application Results Tables: A data table with a list of applications with selected metrics
• Bubble Charts: An application bubble chart with selected metric axes and quadrants
• Column Charts: A column chart that facilitates counting applications grouped by selected metric and score range
• Milestones: Facilitates addition of selected milestones from the Continuous Improvement Tracker feature
• Quick Portfolio Insights
• Vulnerabilities: Facilitates a count and details on CVEs for selected critical levels
• Licenses: Facilitates a count of license occurrences across applications for selected license risk levels
• Trends: Trend chart of the selected metric

Other Feature Improvements: additional enhancements such as Java/.Net deprecated version detection, improved custom segmentations, trends for Technical Debt, improved Azure service recommendations, and much more.

Key Features of CAST SBOM Manager

This innovative technology empowers software product owners, release managers, and compliance specialists with a suite of advanced features:

Automated SBOM Creation: Utilizes sophisticated scanning capabilities to analyze source code or import existing SBOM files, accelerating the process of SBOM generation.

Instant SBOM insights: The dashboard view provides summary stats and insights, including component categories, vulnerabilities, licenses, and more.

Component management: Retrieve and edit component details, add custom metadata, and catalogue components for reuse across other SBOMs.

License management: View and define custom licenses, and manage OSS license risks, obsolescence, and copyrights.

Multi-format sharing: Export SBOMs in various formats such as Excel, Word, and CycloneDX. Import SBOMs from multiple formats and customize them for different audiences.

Addressing Critical Industry Challenges

The introduction of CAST SBOM Manager comes at a time when the software supply chain faces unprecedented scrutiny and regulation. With the rapidly changing compliance & governance landscape, regulated device manufacturers and independent software vendors, now require comprehensive SBOMs to ensure transparency, mitigate security risks, and comply with evolving regulatory frameworks.

Greg Rivera, Vice President at CAST, highlighted the transformative capabilities of the new product, “The product leverages advanced software intelligence to provide an automated, customizable, and user-friendly approach to SBOM management. This product is intended for organizations that need to generate and maintain accurate SBOMs without the complexity and high costs associated with traditional solutions.”

Analyst Comment: Nikhilesh Naik, Principal Industry Analyst at Quadrant Knowledge Solutions suggests, CAST's commitment to advancing software intelligence and governance is evident through the development of the CAST SBOM Manager. By automating and enhancing SBOM processes, CAST empowers organizations to proactively manage software assets, mitigate risks, and optimize operational efficiencies. With the rise in application-related breaches and aggressive focus by US & European governments on integrating & managing SBOM in recent times the launch of CAST SBOM Manager marks a significant milestone in the evolution of software transparency and compliance. For enterprises striving to enhance their software supply chain security and compliance efforts, CAST SBOM Manager represents not only a technological advancement but also a strategic investment in resilience and growth.

Author: Nikhilesh Naik, Principal Industry Analyst at Quadrant Knowledge Solutions