Most systems use package management now; npm is only the poster child. Reviewing a stack of BOMs is going to be a challenge for any organization. Say your prod

Most systems use package management now; npm is only the poster child. Reviewing a stack of BOMs is going to be a challenge for any organization. Say your production Linux has 1000 packages. Each of those might have hundreds or thousands of deps in varying versions, in their respective package managers (BOMs). Business needs to step up its process game. How are BOMS (dep lists) reviewed? Do we expect zero CVEs? How do you filter out false positives, or irrelevant ones? Do you dump everything with that dep or help the maintainer fix it? Many questions.