Skip to main content

SaaSBOM services

A traditional SBOM focuses primarily on the components that make up a software package and not on the third-party services that also go into the final product. This is why a SaaSBOM should be used.

A Software as a Service Bill of Materials, or SaaSBOM for short, can be seen as an extension of an SBOM, as it's used to track components and dependencies specifically related to the SaaS infrastructure.

This Bill of Materials is much more than a simple inventory of all SaaS services included in an application. It also captures dependencies, service endpoints, and data classifications, as well as reliance on other services and the directional flow of data between them, making it more transparent than an SBOM.

With SaaSBOM, users get a better insight into the dynamic relationships between the services their product integrates with. It allows them to check the level of security of those third-party services, as well as identify and more effectively manage risks regarding insecure APIs, vulnerable data exchanges, and misconfigured services. As a result, users can confidently make more informed decisions on what they include in their applications.

What are SaaSBOM services?​

SaaSBOM services are considered those networking URIs that belong to external services an application integrates with.

As applications evolve, they increasingly rely on third-party services to extend their functionality and provide additional features users need. This way, software producers save time and money, as they do not have to build their own solutions for specific parts of the product from scratch.

While these external services that applications connect to offer functionality and efficiency, they also introduce potential risks:

  • Third-party services require access to some sensitive information. Sharing this information with them increases the risk of unauthorized access, data mishandling, or data breaches. This presents an even bigger issue if the third-party service has any known vulnerabilities or poor security hygiene
  • If your product interacts with any insecurely designed APIs, your organization may be more susceptible to attacks
  • Third-party services may not provide sufficient logging or monitoring capabilities, making it difficult to detect and respond to suspicious activities or security incidents
  • Many third-party services, especially cloud providers, use shared infrastructure. If the provider does not properly isolate customer data and workloads, your data can be exposed to risks

Managing multiple integrations and ensuring they work seamlessly can become complex as the number of external services increases. The Spectra Assure platform can help you keep track of all potential security risks these services may carry.

These services are organized into categories based on their purpose. In Spectra Assure analysis reports, they are displayed as service names that contain all detected network locations (i.e., API endpoints) connected with that service. All this information is visible in the SaaSBOM part of the analysis reports when the service URI is detected in the analyzed file.

Spectra Assure also supports creating custom policy controls for detecting self-declared network services, allowing you to tailor the platform to your use-case with your knowledge and expertise.

Supported service categories​