One 2024 survey offers a clear, carefully scoped figure: GitLab reported that 21% of organizations surveyed were using a software bill of materials (SBOM) to document software components. The survey covered more than 5,000 DevSecOps professionals worldwide, but it does not establish a universal adoption rate or a Linux Foundation Research statistic. Adoption also means more than generating an inventory: organizations must consume SBOMs in security, risk, compliance, procurement, or development workflows.
How many organizations used SBOMs in 2024?
GitLab’s 2024 Global DevSecOps Report says 21% of surveyed organizations were using an SBOM to document software components. The survey covered more than 5,000 DevSecOps professionals worldwide. This is a finding from GitLab’s survey, not a globally representative estimate for every organization, industry, or region. Read the report from GitLab.
As an Amazon Associate I earn from qualifying purchases.
The same report says 67% of developers surveyed indicated that at least a quarter of the code they work on comes from open-source libraries. That figure describes developers’ code, not SBOM adoption; it helps explain why visibility into software components matters, but it should not be treated as another adoption measure.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhat does SBOM adoption mean?
Producing an inventory
An SBOM is formal, machine-readable metadata that identifies a software package and its contents. It can also include information such as copyright and license data. The Linux Foundation describes SBOMs as a way to provide transparency about components delivered through a software supply chain. See the Linux Foundation’s SBOM overview.
#1 Best Overall
Production means generating that component inventory. It can give an organization a record to consult when assessing dependencies, investigating a vulnerability, or reviewing license obligations. Generating an SBOM, by itself, does not show that anyone uses it to make those decisions.
Consuming it in workflows
Consumption means using SBOM information in processes such as vulnerability monitoring, risk assessment, compliance, procurement, or software development. Production and consumption are distinct practices, so an adoption percentage is most useful when it makes clear which one it measures.
Rank #2
The Linux Foundation’s earlier cybersecurity-readiness study reported that 48% of respondents were producing SBOMs to some extent and 46% were consuming them to some extent. Those are report-era findings from that earlier study, not measurements of 2024 adoption. They illustrate why production and consumption should not be collapsed into one unqualified rate. Read the Linux Foundation report.
Free tools Windows power users keep installed
One-click scans. No signup required.
What the available evidence can—and cannot—show
| Evidence | What it measures | How to interpret it |
|---|---|---|
| GitLab, 2024 Global DevSecOps Report | 21% of surveyed organizations were using an SBOM to document software components; survey covered more than 5,000 DevSecOps professionals worldwide. | A 2024 publisher-specific survey finding, not a universal or globally representative rate. |
| Linux Foundation cybersecurity-readiness study | 48% producing SBOMs to some extent; 46% consuming them to some extent. | Historical report-era figures, not 2024 estimates. |
| SEI’s SBOM Harmonization Plugfest 2024 report | Examined how differences in SBOM generation can produce different outputs and developed recommendations for more predictable, higher-quality SBOMs. | The project concerned the 2024 Plugfest; the report was published July 17, 2025. |
The available sources do not establish a single globally representative 2024 adoption rate, nor do they establish that “LFR” in the title refers to a particular Linux Foundation Research adoption report. The 21% figure should therefore stay attached to GitLab’s survey and its stated scope.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why generation quality matters
Two generation processes can produce different SBOM outputs, which can make inventories less predictable to downstream users. The Software Engineering Institute’s report on the 2024 SBOM Harmonization Plugfest discusses this challenge and recommendations for more consistent, higher-quality outputs. The report was published on July 17, 2025, so it is evidence about a 2024 project rather than a 2024 adoption survey. Read the SEI report.
A 2024 landscape study surveys open-source and proprietary SBOM tools and frames SBOMs as inventories of third-party components and dependencies. It may help explain why organizations assess tooling, but its reviewed abstract does not support ranking products or making detailed claims about individual tools. Read the study abstract.
Quick Recap
Best Value
Rank #4
How to read future SBOM adoption figures
- Check who was surveyed. A survey of DevSecOps professionals does not automatically represent all organizations or sectors.
- Check the date. A report published in one year may describe earlier fieldwork or a project conducted in a different year.
- Check what “adoption” means. Look for whether the figure concerns SBOM production, consumption, or both.
- Check the measure’s wording. “To some extent,” “using,” and “required” describe different levels of practice and should not be treated as equivalent.
- Check generation consistency. An inventory’s value depends in part on whether its output is sufficiently predictable and useful to the people and systems consuming it.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
