The first exploit didn’t come from a human.
It came from a build pipeline.
Non-human identities — service accounts, machine users, bots, keys, tokens — now own and move more code than people. They commit, test, deploy, ship, and talk to each other at machine speed. Every one of them is part of your software supply chain. Every one of them has access you may not fully see.
A Software Bill of Materials (SBOM) is no longer just about the packages you import. It must account for the full spectrum of non-human identities your system trusts. Without this, your SBOM is incomplete and your security blind.
Non-Human Identities in the SBOM Era
An SBOM that stops at dependencies misses a new surface: the actors moving your code from repo to production. Service accounts in CI/CD, robot users on GitHub, automated deploy agents in Kubernetes, cloud functions with scoped permissions — these are links in your chain. Attackers know it. Breaches often start by hijacking one non-human identity and letting the automation do the rest.
Why Traditional SBOMs Fail Here
Most SBOM formats focus on libraries, versions, and licenses. They rarely model identity relationships, token scopes, or privilege boundaries. Inventorying your components without inventorying your non-human identities leaves silent gaps. Dependencies can be patched. Compromised build bots go unnoticed until they push malicious code straight to release.
Building an SBOM for Machines and Humans
A modern SBOM must include:
- All non-human identities in source control, pipelines, artifact repos, deployment platforms
- Their permissions, scopes, and key rotation status
- Machine-to-machine trust relationships across services and environments
- Associations between identities and the code or artifacts they handle
This detail turns the SBOM into a living map. It shows who — human or not — can touch what in the supply chain. It connects vulnerabilities not just to code but to the actors in motion.
Security, Compliance, and Proof
Regulatory momentum is catching up. Standards are expanding to require stronger identity tracking. For audit and compliance, proof of control over non-human identities is rising in importance. If you can’t show the map, you risk failing the test.
The fastest way to start is to treat identity as a first-class artifact. Record it. Link it to code. Maintain it like you patch dependencies. You need tooling that can pull this into your SBOM automatically.
See how you can build and ship a complete SBOM — including non-human identity data — live in minutes at hoop.dev.