"However, there is an even more worrying effect: if attacks are possible at such a scale that their effect is felt across whole sectors, countries or even globa

"However, there is an even more worrying effect: if attacks are possible at such a scale that their effect is felt across whole sectors, countries or even globally, as is the case with the “SolarWinds” attack, they have the potential to fundamentally undermine our trust in information technology." How is that a worrying effect? Trust in IT systems is undeserved, because they are built in an environment of economic incentives that make stability, performance and security secondary concerns to features and time to market, and poor engineering practices that derive from those incentives. A software BOM will do nothing to address those problems. Healthy skepticism of IT and adapting with defense in-depth and other measures like data minimization (you can't leak what you don't have) are desirable, or even simply using less software.