SBOM Generation Patents: Leaders, Trends & White Space 2026
Filing growth compares 2021 (14 records) with 2024 (98) — a three-year span. 2024 is the most recent year we treat as complete: publication lags filing by roughly 18 months, so 2025 onwards are still filling in and any growth rate that ends there would understate the field. Top-5 share is the combined record count of the five largest assignees divided by all 308 records in scope (CR5), not by the ranked leaders only.
What the SBOM generation patent record shows
Software bill of materials (SBOM) generation moved from a compliance afterthought to an active filing category once supply-chain attacks and government procurement rules made component inventories a documented requirement rather than a best practice. The dataset covers 308 published records filed between 2015 and 2026, drawn from a search string that isolates SBOM generation and closely related component-inventory and software-integration filings from the broader cybersecurity corpus. Filing activity was effectively zero before 2018 and did not accelerate meaningfully until 2021, which places almost the entire body of prior art inside a five-year window.
Because publication lags filing by roughly 18 months, the 2025 and 2026 figures in any trend understate real activity; 2024, at 98 records, is the most recent year that can be read as a complete picture. The concentration data below points to a field with a handful of established filers and a much larger group that has filed once or twice, which is typical of a technology area still being defined rather than consolidated.
Let an AI agent run this analysis on your own technology
Pick a task. Every answer cites the patents behind it.
Filing trends and technology composition
Three views of the same 308-record dataset: how filing volume moved over time, who holds the most families, and which technical classes the filings actually sit in.
A five-year filing surge, not a steady climb
Annual filings sat at zero in 2017 and stayed negligible through the late 2010s. The real inflection is 2021 to 2024, where volume rose from 14 to 98 records — a +600% increase that lines up with the tightening of software supply-chain disclosure requirements over the same period. Treat 2025 and 2026 as still filling in rather than as evidence of a slowdown.
Concentrated in G06F, thin in AI-driven generation
G06F (electric digital data processing) covers 86.0% of the 308 records, confirming that most SBOM generation work is filed as a data-processing problem rather than a security-specific or AI-specific one. H04L (digital transmission, 23.4%) and G06Q (business/administration data processing, 16.9%) trail well behind, and G06N (AI-based computing) appears in only 6.5% of records — a gap worth noting given how much SBOM tooling now markets itself as AI-assisted.
Shares are the percentage of the 308 records in scope. A patent can carry several IPC classes, so the shares add up to more than 100%.
Go deeper on Software Supply-Chain Security: SBOM Generation Patent Landscape with Eureka
This page is one run against one query. Ask Eureka your own question about software supply-chain security: sbom generation patent landscape and every answer comes back with the patent numbers behind it.
Try EurekaA representative filing and the most-cited prior art
Composite software bill of materials management (US12524232B1, Amazon Technologies)
The filing describes a vehicle SBOM management service that generates and updates a composite SBOM from multiple received SBOMs, letting a customer define software artifact instances at chosen granularity, resolving conflicts between differing component records, and handling anomalies encountered during artifact generation.Filed as a 2026 grant, this sits at the newest edge of the dataset and illustrates how SBOM composition and reconciliation — rather than single-source generation — is where recent claims are heading.
| # | Publication no. | Patent title | Citations |
|---|---|---|---|
| 1 | US20070240154A1 | System and method for software integration and factory deployment | 184 |
| 2 | US20050198628A1 | Creating a platform specific software image | 97 |
| 3 | US20200201620A1 | Software Bill of Materials Validation Systems and Methods | 59 |
| 4 | US11841945B1 | System and method for cybersecurity threat detection utilizing static and runtime data | 45 |
| 5 | US20220150270A1 | Cyber digital twin simulator for automotive security assessment based on attack graphs | 41 |
| 6 | US20220083652A1 | Systems and methods for facilitating cybersecurity risk management of computing assets | 26 |
| 7 | US20240403437A1 | External API vulnerability assessments | 24 |
| 8 | US20240031394A1 | Control flow prevention using software bill of materials analysis | 24 |
| 9 | US20230208880A1 | Automating trust in software upgrades | 24 |
| 10 | US20230359744A1 | Risk assessment based on software bill of materials | 23 |
Citation counts reward older filings simply for being searchable longer; read them as a signal of influence on the field, not as a ranking of current technical importance.
Each row carries its publication number; clicking a row searches Eureka by that number.
Put your own technology through the same analysis
Eureka on the web
When you want the answer in the next five minutes.
The agent works the prompt against patents and technical literature, citing every source.
Run your analysis now →MCP server & REST API
When it has to run inside your own pipeline.
Patent search, landscape analysis and assignee resolution as MCP tools. Drop them into any agent framework, or call REST directly.
Browse MCP servers →What the numbers mean for a filing decision
Read together, the concentration, growth and classification figures point to a field that is young, unevenly claimed, and still forming around a few large filers.
The leaders hold less than a third of the field
The leading assignee holds 38 records and the fifth-place holder just 9, so the top five combined account for 32.1% of all 308 records in scope. That leaves close to two-thirds of the corpus spread across a long tail of companies with a handful of filings each — a pattern more consistent with an emerging category than a settled one.
The surge is recent and concentrated in three years
Filings rose from 14 in 2021 to 98 in 2024, a +600% increase that coincides with heightened regulatory and procurement attention to software supply-chain risk. Because publication lags filing, treat 2025-2026 counts as incomplete rather than as a plateau or decline.
AI-assisted SBOM generation is thinly claimed
G06F covers the large majority of records at 86.0% of the 308 in scope, while G06N (AI-based computing) appears in only 6.5%. Given how much current SBOM tooling is marketed around AI-driven dependency analysis, this gap suggests the claim space around AI-assisted generation methods is not yet heavily occupied.
Eureka can read the same corpus for gaps instead of for coverage: under-claimed branches adjacent to software supply-chain security: sbom generation patent landscape, with the prior art for and against each one.
Where to take this next
The dataset points to specific next steps depending on whether the goal is freedom-to-operate, competitive tracking, or identifying open claim space.
Map the white space before drafting claims
The gap between G06F's 86.0% coverage and G06N's 6.5% suggests AI-assisted and automated SBOM generation methods are comparatively open. Confirm this against the specific claim language of the leading assignees before committing to a filing strategy.
Explore white space in EurekaTrack the leaders as the field consolidates
With the top five holding 32.1% of 308 records and the tenth-ranked holder at just 6 records, watch whether the leading assignees expand their share as 2025-2026 filings publish, or whether the long tail keeps growing.
Set up assignee tracking in EurekaRead the most-cited prior art before filing
Records cited well above 40 times, including the earliest software-integration and platform-image filings, define the baseline that newer SBOM-specific claims are drafted around.
Review cited prior art in EurekaCommon questions about SBOM generation patents
The dataset used for this landscape contains 308 published records filed between 2015 and 2026 that match SBOM generation, software bill of materials, and closely related component-inventory generation search terms. Filing activity was minimal before 2018 and only began accelerating from 2021 onward, so the great majority of these records are recent. Because publication lags filing by around 18 months, the true 2025-2026 filing count will be higher once those applications finish publishing.
Filing activity is concentrated but not dominated by a single company: the top five assignees together hold 32.1% of all 308 records in scope, with the leading assignee alone accounting for 38 records. The remaining share is spread across a long tail of the 100 companies in the ranked assignee list, most of which have filed only a handful of times. This pattern suggests active competition rather than a settled market led by one or two firms.
Filings rose from 14 in 2021 to 98 in 2024, a +600% increase over that three-year span. This period overlaps with growing regulatory and procurement pressure around software supply-chain transparency, which pushed SBOM generation from a niche compliance practice into an active engineering and product category. Readers should treat 2025 and later filing counts as still incomplete rather than as a sign the growth has stopped.
Not yet, based on this dataset. G06N, the IPC subclass covering AI-based computing, appears in only 6.5% of the 308 records, compared with 86.0% for G06F, the general electric-digital-data-processing subclass that most SBOM generation filings fall under. That gap indicates that methods combining SBOM generation with AI-driven analysis or automation are comparatively under-claimed relative to how much that combination is discussed commercially.
A useful example from the newest end of this dataset is US12524232B1, filed by Amazon Technologies, which describes a service that generates and reconciles a composite SBOM from multiple received SBOMs for a vehicle, including handling conflicts between differing component records and resolving anomalies during artifact generation. This reflects a broader shift in recent filings toward SBOM composition and reconciliation across multiple sources, rather than generation from a single source. Anyone drafting in this space should check claim scope against reconciliation and conflict-resolution language specifically, since that is where recent activity is concentrated.
Research Software Supply-Chain Security: SBOM Generation Patent Landscape in depth with Eureka
Go past this page: query the whole software supply-chain security: sbom generation patent landscape corpus yourself, in your own scope.
Every answer comes back with patent numbers you can open.
Disclaimer. This page is generated from Patsnap Eureka data drawn from a limited snapshot of global patent and scientific-literature records, and is provided for general information and reference only.
Patent data carries inherent limitations: recent filings (typically the most recent 18–24 months) are under-counted due to standard publication lag; counts may be reported at either a patent-family or a patent-record basis and are not always directly comparable; classification, applicant-name, and citation data may contain errors, duplicates, or omissions; and the underlying search query defines and constrains the scope shown. As a result, the analysis may be incomplete or inaccurate and may not reflect the full technology landscape.
Nothing on this page constitutes an exhaustive prior-art, novelty, freedom-to-operate, or validity search, nor does it constitute legal, financial, investment, or professional advice, and it should not be relied upon as such. Any patent, commercial, or strategic decision should be verified independently and reviewed with qualified patent, legal, and domain professionals. Patsnap makes no warranties, express or implied, as to the accuracy, completeness, or fitness for any particular purpose of the information presented.
Machine translation. Assignee and organisation names originally recorded in Chinese, Japanese or Korean have been rendered into English by an AI translation step so that the tables stay readable. These renderings are best-effort and may not match a company’s registered English name; the original name is what the underlying patent record carries, and it is what any Eureka query launched from this page uses.