Read an SBOM Inventory With Its Coverage Map

Athelguard Editorial · Latest Insights

When a software package disappears from a security inventory, the first question should be what changed: the software, the resource, or the ability to observe it.

On November 6, 2026, AWS introduced an SBOM inventory in Security Hub, bringing package and version information from Amazon Inspector into a central view. A software bill of materials, or SBOM, records the components found in software or on a resource. The new view can make it easier to locate a package across a fleet.

The AWS documentation adds an important qualification: software leaves the inventory when its resource is deleted, terminated, or leaves Inspector coverage. New SBOM information can also take a few hours to appear. An empty result therefore needs an explanation before it supports an assurance about the whole environment.

Keep four evidence states separate

Ask for the coverage record alongside the package list

For a business evaluating a supplier, a useful evidence request has three parts:

• The intended scope. List the production services and supporting resources that matter to your use case. Reconcile that list with the accounts, Regions and resource types included in the inventory. Start with a resource list independent of the package search, so missing resources remain visible.
• The observation conditions. Record the collection time, inventory-view time, scan method and unresolved collection errors. Inspector exposes coverage information, including resources that are not scanning and reasons such as pending scans, stale inventory or unsupported systems. Enabled scanning alone does not settle whether the evidence is current and complete.
• The explanation for changes. If a package disappears, determine whether it was removed, its host was retired, or observation stopped. Preserve the resource identifier and the evidence behind that classification rather than reporting a falling package count as an improvement.

For example, a supplier might search for an affected library and get no matches after a workload moves to an unscanned account. The result describes the remaining observed scope; it does not establish the library’s absence from the moved workload. This is a hypothetical assessment scenario, not a finding about AWS or any supplier.

Make the conclusion as narrow as the evidence

Athelguard’s assessment view is to report what was observed, where, when, and what remains outside the check. A package’s presence also needs interpretation: it does not establish that a vulnerability is reachable in a particular application. Coverage and exploitability are separate questions.

The practical deliverable is a package list plus a coverage record, with an owner and next check for each material gap. That gives businesses a clearer basis for further investigation than a single reassuring total.

Source review: November 7, 2026. This article interprets public documentation; Athelguard has not tested the service or assessed a named supplier here.