@joshbressers: "If you can't search your past builds, you can't bound your blast radius.

@joshbressers: "If you can't search your past builds, you can't bound your blast radius. SBOMs turn a frantic morning into a simple query."

His zero-day incident response story from inside Anchore's response to the NPM supply chain attack:

https://anchore.com/blog/a-zero-day-incident-response-story-from-the-watchers-on-the-wall/