What is an HBOM? The hardware bill of materials, explained
An HBOM is a machine-readable inventory of hardware components - the chips, modules, and firmware in a device or system. It answers, for physical products, the same question an SBOM answers for software: when a vulnerability is disclosed in a component, which of our products contain it? It matters most for connected products, medical devices, and critical infrastructure, where regulation is beginning to require component transparency.
An HBOM, a hardware bill of materials, inventories the physical and firmware components of a device or system: the processors, modules, and other significant parts, and critically the firmware running on them. It brings the SBOM discipline to hardware, because connected products face the same core question software does - when a vulnerability is disclosed in a component, which of our products contain it? - and most manufacturers cannot currently answer it for their hardware.
Why hardware needs a bill of materials now
For decades, hardware security was a specialist concern. Three shifts changed that:
- Everything is connected. A device on a network is attackable, and its exposure depends on components its operator never chose and often cannot see.
- Firmware is software with hardware’s lifecycle. The exploitable, patchable layer of most hardware is its firmware - which has versions and vulnerabilities like any software, but ships and ages inside physical products that stay deployed for years.
- Regulation arrived. Frameworks attaching security obligations to products with digital elements - the EU Cyber Resilience Act, FDA device cybersecurity - push component transparency onto manufacturers, and hardware is squarely in scope.
The honest boundary on generation
An HBOM has a limit worth stating plainly, because it separates credible tooling from marketing. The full board-level, die-level parts list is knowledge only the original manufacturer holds; no external tool can fabricate it. What can be generated is the as-deployed inventory - what is actually present and running:
- Host introspection: firmware versions, device and module identifiers, chip identities, and security-feature state read from the running system.
- Firmware image analysis: unpacking firmware to inventory the software components inside it - a firmware SBOM in its own right, since firmware bundles operating systems and libraries with their own known vulnerabilities.
- Vendor HBOM ingest: where a manufacturer does provide a hardware BOM, consuming and monitoring it.
A trustworthy HBOM tool is explicit about which path produced each entry and declares what it could not determine, rather than presenting a partial inventory as a complete manufacturing record.
What it is for
Like every bill of materials, the value is in the lifecycle, not the snapshot. An HBOM stored and monitored against new disclosures turns “is this newly announced firmware vulnerability in any of our fielded devices” from a fire drill into a query - the continuous-monitoring property that makes BOMs worth maintaining rather than merely producing.
BOMNexa includes the HBOM as one of its five BOM dimensions, generating as-deployed hardware and firmware inventories, ingesting vendor HBOMs where available, and monitoring them alongside the software, cryptography, and AI inventories - with the manufacturing-BOM boundary stated honestly rather than papered over.
Frequently asked questions
How can an HBOM be generated without the manufacturer's parts list?
There is a boundary here worth being honest about. The complete board-level parts list is knowledge only the manufacturer has. But an as-deployed inventory can be built from the running system - firmware versions, device identifiers, chip and module identities read from the host - and from firmware image analysis. That covers the security-relevant question of what is actually running, even when the full manufacturing BOM is unavailable.
Why does firmware belong in an HBOM?
Because firmware is where most hardware vulnerabilities are actually exploitable and patchable. A chip's silicon is fixed, but its firmware has versions, known vulnerabilities, and updates - so the firmware inventory is the part of an HBOM that most often answers am-I-affected questions.
Who needs HBOMs?
Makers and operators of connected products, medical devices, automotive systems, and critical infrastructure - sectors where a component-level vulnerability can have physical consequences and where regulation such as the EU Cyber Resilience Act and FDA device guidance is pushing component transparency onto manufacturers.