arxiv.org/abs/2607.22140 No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild
An analysis of 78,612 real-world SBOM files found that 52.9% declare no dependency edges and 8.8% leave most components isolated, with only 38.3% forming well-connected graphs. The authors argue that treating 'no path' as 'unreachable' is unsound, and an explicit 'unknown' level restored KEV recall from 0.600 to 0.950 in a vulnerability-prioritization system.
— via arXiv Software Engineering, Artur Zi\k{e}ba-Kozarzewski
