WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2026 Europe • Jul 9, 2026 • Session details

One Pipeline, Three Regulator - SBOM Compliance for the Developer

Marcus Ross

Turn complex regulations like the EU Cyber Resilience Act into a natural byproduct of your pipeline. Automate SBOM compliance and vulnerability scanning without drowning in paperwork.

Pause
Mute Enter Fullscreen
#1 about 7 min

Legal frameworks mandating software bill of materials

European regulations like the Cyber Resilience Act require product teams to build transparency by tracking software components.

#2 about 3 min

Satisfying ISO 27001 supply chain and vulnerability requirements

Using a software bill of materials acts as an inventory to provide technical evidence for ISO 27001 audits.

#3 about 3 min

Securing code provenance with digital identity signatures

Cryptographically tying developer identity to code commits secures code systems against spoofing and establishes verifiable provenance.

#4 about 2 min

Implementing keyless commit signing with Sigstore gitsign

Configuring version control with ephemeral certificates simplifies developer onboarding by signing code without long-lived keys.

#5 about 3 min

Distinguishing between basic sign-offs and cryptographic signatures

Recognizing the distinction between simple text sign-offs and cryptographic signatures prevents unverified release artifacts.

#6 about 3 min

Resolving the SPDX and CycloneDX format dilemma

Using open-source tools to flawlessly convert between formats eliminates friction inside continuous integration pipelines.

#7 about 3 min

Navigating the CVE data crisis and fragmented vulnerability streams

Consolidating multiple package ecosystem feeds counters the data crisis caused by slowdowns at the National Vulnerability Database.

#8 about 3 min

Scanning software distributions with the OpenSSF OSV schema

Leveraging the OSV-Scanner allows offline, version-accurate vulnerability matching directly against a software bill of materials.

#9 about 3 min

Collaborating on risk appetite and CVE remediation strategies

Facilitating discussions between engineering and security operations establishes realistic vulnerability remediation expectations instead of aiming for zero.

#10 about 2 min

Unifying software compliance into standard delivery pipelines

Embedding code provenance and bill of materials generation directly into deployment commands turns compliance into a natural byproduct.

Matching moments

2:46 min

Mapping the complete software supply chain attack surface

Matthew Brady Matthew Brady · WWC Europe 2026

4:55 min

Automating compliance checks into delivery pipelines

Antoine Thomas Antoine Thomas · Europe 2026 Virtual

3:07 min

Navigating software integration compliance in safety automotive environments

Nico Schmidt · LIVE

4:00 min

Core principles for implementing DevSecOps in teams

Aarno Aukia · LIVE

3:58 min

Exploring advanced security tooling and community dependency vetting

Niels Tanis Niels Tanis · WWC 2024

2:46 min

Adopting actionable frameworks for software bills of materials

Vandana Verma · LIVE

More from World Congress 2026 Europe

Building the Nervous System of AI - Michael Kagan (NVIDIA) thumbnail
29:17
about 1 month ago

Building the Nervous System of AI - Michael Kagan (NVIDIA)

Michael Kagan, Sead Ahmetović

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote thumbnail
19:41
about 1 month ago

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote

Christian Heilmann

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend thumbnail
32:06
about 1 month ago

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend

David vonThenen

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes thumbnail
35:13
about 1 month ago

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes

Irina Branovic

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬 thumbnail
24:23
about 1 month ago

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬

Jeremy Murray

Angstfreude - AI and Corporate Culture - The Thrill and the Threat thumbnail
30:26
about 1 month ago

Angstfreude - AI and Corporate Culture - The Thrill and the Threat

Axel Ebert, Karin Krobath

Upcoming sessions on this topic

Open session

World Congress 2026 North America

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy
Open session

World Congress 2026 North America

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp
Open session

World Congress 2026 North America

Secure-by-Inclusion: Preventing Accessibility Barriers from Becoming Security Vulnerabilities

Radostina (Ina) Tsvetkova

Norwegian Directorate of Labour and Welfare (NAV), Senior Advisor in Digital Accessibility and Inclusive Design

Radostina (Ina) Tsvetkova
Open session

World Congress 2026 North America

From Guesswork to Governance: Data Contracts Bring API Discipline to Apache Kafka

Sandon Jacobs

Senior Developer Advocate at IBM

Sandon Jacobs
Open session

World Congress 2026 North America

rm -rf: Horror Stories From Unsandboxed AI Agents (and How Docker Fixes This)

Rishab Kumar

Staff Developer Evangelist @ Twilio

Rishab Kumar
Open session

World Congress 2026 North America

Don’t kill my Vibes - Simple Steps to Stay Secure when Vibe Coding

Isaac Evans

Co-founder & CEO of Semgrep

Isaac Evans

Related videos

Securing your application software supply-chain thumbnail
28:27
WWC 2022 • about 4 years ago

Securing your application software supply-chain

Niels Tanis

Beyond SBOMs: The Future of Container Supply Chain Security thumbnail
30:38
WWC Europe 2026 • about 1 month ago

Beyond SBOMs: The Future of Container Supply Chain Security

Mohammad-Ali A'râbi

Reporting Active Exploits in 24 Hours: Are You Ready for the CRA? thumbnail
32:18
WWC Europe 2026 • about 1 month ago

Reporting Active Exploits in 24 Hours: Are You Ready for the CRA?

Matthew Brady

Walking into the era of Supply Chain Risks thumbnail
37:36
LIVE • over 4 years ago

Walking into the era of Supply Chain Risks

Vandana Verma

My Lawyer Merged My PR: Automating OSS Compliance at Scale thumbnail
29:40
WWC Europe 2026 • about 1 month ago

My Lawyer Merged My PR: Automating OSS Compliance at Scale

Uwe Korn

Security Pitfalls for Software Engineers thumbnail
27:32
WWC 2023 • almost 3 years ago

Security Pitfalls for Software Engineers

Jasmin Azemović

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.