SBOM and Open-Source Software Risk Management Corporate Training
Learn to inventory, assess, and defend open-source dependencies with SBOMs, SCA triage, and supply-chain controls in live guided labs.
Edstellar, a corporate training company, delivers corporate training that helps your team learn to manage open-source software risk end to end. Employees build skills in SBOM generation, vulnerability triage, license compliance, and supply-chain defense through hands-on labs led by practitioners. Each session is tuned to your stack, tools, and workflows.
Instructor-led group trainingVirtual / on-site / off-site10 languagesDelivered inEnglish, Spanish, Mandarin, German, Arabic, Portuguese, Hindi, French, Japanese, Italian100+ countriesWe have delivered inUnited States, United Kingdom, India, Canada, Germany, France, Netherlands, UAE, Saudi Arabia, Singapore, Australia, Japan, Brazil, South Africa and 90+ more countries
How we build a supply-chain-ready team
The Edstellar OPEN-SOURCE RISK CAPABILITY MODEL
Assess open-source risk capability
Skill checks map your team's SBOM knowledge, SCA experience, and license compliance baseline.
Set shared inventory standards
One shared playbook for SBOM generation, vulnerability triage, and license review.
Practice in guided labs
Labs cover SBOM generation, SCA triage, license scans, and pipeline gates.
Measure the lift
Lab reviews benchmark each employee's SBOM and triage capability.
Scale across teams
One standard rolls out across products, pipelines, and teams.
Need more than one program?Get a group quote
Trusted as a Leading Corporate Training Provider by
Program Overview: What is SBOM and Open-Source Software Risk Management?
SBOM & Open-Source Software Risk Management is Edstellar's instructor-led technical program for engineering and security teams shipping software built on open source. Participants learn open-source risk fundamentals, SBOM generation in SPDX and CycloneDX formats, and software composition analysis for vulnerability detection. The program also covers license compliance and legal risk, plus supply-chain defense practices.
The labs are the heart of the program. Your team generates SBOMs from real projects, runs SCA tooling to detect vulnerabilities, triages findings with VEX statements, and reviews license obligations with instructor guidance on judgment calls. Each lab closes with a review of what was found and what it means for shipping. The capstone is a full open-source risk assessment of a realistic codebase.
Modern software is mostly someone else's code, and teams that cannot inventory their dependencies cannot secure them. A critical vulnerability in a transitive dependency becomes your incident. This program teaches teams to see their software supply chain clearly: generate the bill, scan it, license-check it, and defend it by policy.
The capstone produces a Full Open-Source Risk Assessment: participants generate the SBOM, run the scans, resolve the licenses, and write the risk report for a realistic codebase. The report format they take home is one their own release process can adopt immediately.
Modern products are assembled from open source, and attackers know it. This program moves your team from unknown dependency risk to managed supply-chain security: trustworthy SBOMs for every release, triage that separates real risk from noise, license reviews that keep legal exposure low, and pipeline gates that enforce the standard. Every module ends in a lab where employees generate artifacts and make real triage decisions. The capstone is a full open-source risk assessment, reviewed by the instructor against an industry-aligned checklist. You leave with SBOM templates, triage checklists, and a policy starter kit your team can apply immediately.
What's Included in this Workshop for Your Enterprise Teams
- 1
SBOM generation workflows
Build SPDX and CycloneDX SBOMs for releases.
- 2
SCA triage labs
Scan, triage, and prioritize vulnerability findings.
- 3
License compliance
Review licenses and draft compliance policy.
- 4
Supply-chain defense
Sign artifacts and gate pipelines on SBOMs.
- 5
Capstone assessment
Full open-source risk review of a sample product.
- Instructor-led delivery across virtual, onsite, and hybrid
- Guided labs in every module with instructor coaching
- Capstone open-source risk assessment, reviewed with your team
- Flexible scheduling around your calendar
- Lab guides and SBOM templates included
- Group size and batches set along with you
Build your team's skills. Anywhere in the world.
Real-world use cases
from day one
Instructor-led training
for your teams
Delivered globally
in 100+ countries
Enterprise Training Solutions Customized for Your Company
One partner for instructor-led corporate training, delivered the way your teams work.
Request a Training Quote- Customized Training Delivery
- Scale Your Training: Small to Large Teams
- In-person Onsite, Live Virtual or Hybrid Training Modes
- Plan from 2000+ Industry-ready Training Programs
- Hands-On Labs on Live Infrastructure, Led by Industry Experts
SBOM and Open-Source Software Risk Management Course Topics and Program Outline
A tailored 24-hour, six-module workshop: one learning journey from open-source risk fundamentals to a capstone risk assessment. Sessions pair concepts with labs on real-world use cases. Materials include lab guides and SBOM templates, plus a capstone assessment.
Built by Edstellar with supply-chain security practitioners
Built by practitioners who run SBOM and SCA programs in production, shaped around your stack and use cases.
Skill checks baseline your team's SBOM knowledge, SCA experience, and license compliance awareness before training begins.
Live instruction covers open-source risk, SBOM formats, and generation workflows across 6.5 focused hours.
Guided labs build detection skill across 8 hours: SCA scans, vulnerability triage, and license reviews.
Your team applies defense policies and delivers a capstone open-source risk assessment in 9.5 hours, reviewed by the instructor.
From SBOM generation to a capstone risk assessment, every technique is practiced in guided labs.
Delivered as
Delivered as a hybrid program of live instruction and guided labs, scheduled around your team's calendar in flexible batches.
Map the dependency tree of a sample application and identify its highest-risk packages.
learna)How open source reaches production software
b)Dependency trees and transitive risk
c)Supply-chain attack patterns and case studies
d)Lab environment and tooling setup
Generate SPDX and CycloneDX SBOMs for a sample project, then validate and compare them.
learna)SPDX and CycloneDX format essentials
b)Generating SBOMs from source and builds
c)Validating SBOM completeness and accuracy
d)SBOM storage, versioning, and sharing
Run SCA scans on a lab codebase, triage findings by reachability, and produce a prioritized fix list.
practicea)Software composition analysis workflows
b)Matching findings to CVE and advisory data
c)Triage by reachability and exploitability
d)Reducing scanner noise in large codebases
Scan a lab project for license obligations, flag copyleft exposure, and draft a remediation note.
practicea)Permissive vs copyleft license families
b)Copyleft exposure in commercial products
c)License scanning and attribution
d)Drafting an OSS compliance policy
Sign build artifacts, author a VEX statement, and add an SBOM gate to a sample pipeline.
applya)Signing artifacts and verifying provenance
b)VEX: communicating exploitability status
c)Update, pinning, and quarantine policies
d)Integrating SBOM checks into CI pipelines
Assess a sample product end to end and present a risk register with remediation priorities.
applya)Scoping the assessment
b)SBOM generation and vulnerability triage
c)License review and risk register
d)Remediation plan and stakeholder summary
Customize this program tailored to your team?
Tell us your training needs: what your team already works with, the level they’re at, and the topics you want them to focus on. We’ll adjust the modules, duration and hands-on labs, and send you a customized outline for your group.
Key Skills and Outcomes Your Team Will Gain
Seven job-ready outcomes your team will demonstrate by the end of the program. Each competency is practiced in guided labs and reviewed in the capstone assessment.
Generate SBOMs in SPDX and CycloneDX
Produce complete, validated SBOMs from source and builds in both industry formats.
Run software composition analysis
Scan codebases for known vulnerabilities and match findings to CVE and advisory data.
Triage findings by exploitability
Separate reachable, exploitable risk from scanner noise with a repeatable triage routine.
Assess open-source license risk
Classify licenses, spot copyleft exposure, and document obligations for commercial products.
Author VEX and provenance artifacts
Communicate exploitability status with VEX and verify artifact provenance with signing.
Set supply-chain defense policies
Define update, pinning, and quarantine policies, plus SBOM gates in CI pipelines.
Deliver open-source risk assessments
Produce a risk register with remediation priorities your stakeholders can act on.
Teams that Benefit from this SBOM and Open-Source Software Risk Management Group Training
This group training is built for teams that ship software on open source and want supply-chain risk under management instead of unknown. Content adapts to each cohort's roles, stack, and experience, so every batch practices the workflows it owns, from SBOM generation to remediation.
Tame open-source risk with SBOM discipline.
Security engineers learn to generate SBOMs, triage SCA findings by exploitability, and track supply-chain risk over time.
Workflow friction
- Unknown dependency inventory
- Scanner noise without triage
- Untracked supply-chain risk
How the program helps
- Validated SBOMs for every release
- Triage by real exploitability
- Supply-chain risk visibility
Practice use cases
- SBOM generation labs
- SCA triage drills
- Risk register practice
Ship with dependencies you can trust.
Developers learn to read dependency risk, choose safer packages, and keep SBOMs accurate as code changes.
Workflow friction
- Blind package adoption
- Stale dependency inventories
- Late vulnerability surprises
How the program helps
- Safer package selection
- Accurate SBOMs per release
- Fewer vulnerable dependencies
Practice use cases
- Dependency review labs
- SBOM update drills
- Package selection exercises
Gate pipelines on software inventory.
Platform teams add SBOM generation and vulnerability gates to CI pipelines, with signing and quarantine policies.
Workflow friction
- No build-time SBOM checks
- Unsigned release artifacts
- Risky packages reaching prod
How the program helps
- SBOM gates in CI pipelines
- Signed, verifiable artifacts
- Quarantine for risky packages
Practice use cases
- Pipeline gate labs
- Signing setup drills
- Policy config exercises
Keep licenses out of the courtroom.
Compliance teams classify license obligations, spot copyleft exposure, and build an OSS policy the business can follow.
Workflow friction
- Unknown license obligations
- Copyleft in shipped products
- No approved OSS policy
How the program helps
- Clear license obligations
- Copyleft exposure flagged early
- Enforceable OSS policy
Practice use cases
- License scan labs
- Policy drafting drills
- Attribution practice
Cohorts train as a cross-functional workforce, with each small group aligned on shared inventory and triage standards.
Prerequisites: This program benefits developers, security engineers, DevOps engineers, and compliance teams who manage open-source dependencies. Basic familiarity with software builds and package managers helps but is not required, and no prior SBOM experience is needed. Content adapts to each cohort's tools, stack, and experience level.
Developer to Supply-Chain Security Practitioner
Tracks how team members progress from basic SBOM generation to advanced supply-chain defense across the program's learn, practice, and apply phases.
A program that grows with security careers, from first SBOM to confident supply-chain defense.
Mixed cohort, or several teams at once?
We can tailor the training to different teams, roles, and experience levels within the same program.
Certificate of Training Completion.
On successful completion, employees receive an Edstellar course completion certificate, recognizing their commitment to ongoing learning and professional development. It validates the skills they have built and motivates them to keep growing and contribute to organizational success.
Earned, not attended. Awarded on completion of all hands-on labs and the capstone project.
Training Delivery Modes: Virtual, Onsite and Hybrid
Instructor-led training across virtual, onsite, and hybrid modes, with guided labs in every module.
Hybrid Training
Instructor-led sessions mix onsite and virtual delivery with guided labs throughout. Teams generate SBOMs and triage findings together while the instructor coaches and reviews. Hybrid keeps scheduling flexible without losing live interaction.
- Live instruction across onsite and virtual sessions
- Guided labs with instructor coaching and finding reviews
- Real SBOM and triage workflows throughout
- Flexible scheduling without losing live interaction
Onsite Training
The instructor delivers the full program at your offices, with labs set up on your network and tooling. Onsite sessions make it easy to work on your own codebases and align inventory standards across teams.
- Full program delivered at your offices
- Labs on your network and tooling
- Work on your own codebases
- Team-wide inventory standards alignment
Live Virtual Training
Live virtual sessions on Zoom or Teams deliver the same guided labs and instructor coaching as onsite. Breakout rooms keep lab groups small, and the instructor reviews every team's artifacts.
- Live instructor-led virtual sessions
- Same guided labs as onsite delivery
- Small lab groups in breakout rooms
- Instructor review of every artifact
Need a training format that works for your team?
Full days, half days across weeks, or split by module. Tell us the delivery window and we schedule the cohort around it.
Frequently Asked Questions
Share your team size, timelines, and delivery preference, and we will send a detailed per-group quote with batch options.
Yes. Book a discovery call and we will map your software stack, SBOM maturity, and goals to a tailored training plan before you commit.
Yes. Live virtual sessions run on Zoom or Teams with the same guided labs and instructor coaching as onsite delivery.
Yes. The instructor runs the full program at your offices, with labs set up on your network and tooling for a realistic practice environment.
The program runs 24 hours of instructor-led training, usually across three to six days or weekly sessions on a flexible, mutually agreed schedule.
Question not answered here?
Put it in the request. A training specialist answers it directly, within one business day.
Where this Training Fits in Your Team's learning path.
SBOM and open-source risk sits after secure coding and a secure development lifecycle, because component tracking only works inside a disciplined build process. Once your team manages SBOM risk, it is ready to meet the EU Cyber Resilience Act obligations for products with digital elements.
Why Choose Edstellar as Your SBOM and Open-Source Software Risk Management Corporate Training Provider
When comparing providers, Edstellar is the training partner teams choose for supply-chain security expertise and 5+ years of corporate training experience. Our methodology blends concise instruction with guided labs, and we share each trainer profile before booking. The result is release discipline your team applies from the next sprint.
EXPERT TRAINERS
YEARS DELIVERING
ORGANIZATIONS TRAINED
CERTIFIED
Tailored
Every cohort's labs, examples, and policy templates are tuned to your build tooling, package ecosystems, and compliance standards.
Proven Methodology
Concise instruction followed by guided labs and reviews, a repeatable method that turns inventories into verified defenses.
Practice-Based Learning
Six modules of guided labs and a capstone assessment keep your team scanning, not just listening.
Expert Trainers
Practitioners who run SBOM programs in production lead every session and review your team's assessments.
Global Scale
One consistent program delivered across your offices worldwide, in 10+ languages.
Measurable Outcomes
Lab checkpoints and a capstone assessment prove skill gains you can report internally.
Turn Software Dependency Evidence Into Prioritized Open-Source Risk Decisions
Edstellar connects software inventories with practical vulnerability, licensing, and supply-chain controls. Teams generate SBOMs, examine composition-analysis findings, and develop supporting policy and VEX artifacts. A product risk assessment is reviewed for inventory quality, defensible prioritization, and a clear explanation of the evidence behind proposed remediation.
- Step 01
Consult
We discuss build-process familiarity, dependency visibility, and vulnerability-triage challenges to identify gaps in SBOM generation, license analysis, and supply-chain evidence.
- Step 02
Plan
Open-source risk foundations lead into SPDX and CycloneDX, composition analysis, licensing, and defensive policies before an end-to-end product assessment.
- Step 03
Align
Software-supply-chain expertise supports developers, security, DevOps, and compliance teams, connecting technical findings with each role's responsibilities for release and risk decisions.
- Step 04
Customize
Sample repositories and dependency inventories reflect relevant software patterns without exposing proprietary source code, private package credentials, or confidential vulnerability information.
- Step 05
Execute
Teams generate and validate SBOMs, investigate findings, and add signing and policy checks, receiving feedback on completeness, exploitability reasoning, and VEX clarity.
- Step 06
Evaluate
We assess the risk register for traceable dependencies, supported vulnerability and license conclusions, justified remediation priorities, and clear documentation of uncertainty.
Also from Edstellar
Talent assessments
Psychometric, behavioral, leadership and 360-degree assessment.
→Training needs analysis
Needs analysis, gap identification, and a training roadmap.
→L&D consulting
Learning strategy, content, technology and ROI measurement.
→OD consulting
Org design, succession planning and cultural change.
→Managed training services
Training outsourcing, vendor management, logistics and administration.
→Coaching solutions
Executive and manager coaching that keeps skills in use.
Start an RFP shaped to your needs.
Answer three quick questions about team size, scope, and how often you need the program run, then send the request from the last step. Everything you choose travels with it, so you only fill this in once.
How many team members need training?
SBOM & Open-Source Software Risk Management Training Training Packages & Pricing
Where L&D holds an annual budget, license packages price the whole year at once instead of raising a purchase order per workshop. Hours and licenses are pooled across teams, programs and locations, so unused capacity is not stranded in one department.
Starter
120
trainee licenses64 hours of group training
Tailored for SMBs
Growth
320
trainee licenses160 hours of group training
Ideal for growing SMBs
Enterprise
800
trainee licenses400 hours of group training
Designed for large corporations
Custom
Unlimited
trainee licensesDuration set by the rollout
Multi-region and multi-year
Training Packages & Pricing
Choose the training format that works for your team. Pricing is customized based on your requirements, cohort size, and delivery needs.
Request SBOM and Open-Source Software Risk Management Training for Your Team
Share your team size, build tooling, SBOM maturity, and timelines to receive a tailored training plan and quote. Book a discovery call to discuss your goals; we confirm availability and respond with a proposal.