A product security team receiving a SBOM (CycloneDX or SPDX format) from a software vendor during procurement due diligence needs to assess the security risk of the component inventory — identifying known vulnerable components, licence risks, unmaintained packages, and supply chain integrity concerns — before signing a contract or approving production deployment.