---
title: "Deutsche Bahn's Approach to Large-Scale SBOM Collection and Use"
date: 2026-02-01
categories:
  - english
  - presentation
tags:
  - OSPO
  - SupplyChain
  - Security
headerimage:
  src: firstslide.jpg
video: https://video.fosdem.org/2026/ud2208/7EYTRJ-deutsche-bahn-large-scale-sbom-approach.av1.webm
slides: https://fosdem.org/2026/events/attachments/7EYTRJ-deutsche-bahn-large-scale-sbom-approach/slides/267417/2026-02-0_wtntumx.pdf
event:
  name: FOSDEM 2026
  href: https://fosdem.org/2026/schedule/event/7EYTRJ-deutsche-bahn-large-scale-sbom-approach/
---

500,000 SBOMs -- that's the scale of Deutsche Bahn's software supply chain. In this FOSDEM 2026 session, I showed how we extend our automated collection of Source, Build, Artifact, and Runtime SBOMs from both internal systems and external suppliers, and how we make this data usable. Doing this, we understand that SBOMs are not a tool by themselves but a supporting method for various use-cases. To facilitate them, we heavily rely on FOSS tools, enriched with own logic to fit into our enterprise architecture.

But tools and clever ideas aren't enough. We need people to integrate them into pipelines and continuously monitor the quality of the resulting SBOMs and derived findings. We depend on cooperation from operators of related internal services. And we also need support from our governance stakeholders. This session was about our journey, where we stand today, and what lies ahead.
