TBOM stands for Trusted Bill of Materials. It is a proposed security artifact that goes beyond a software component list by trying to record not only what is inside a package, but also what was checked and what evidence supports that check. In practice, TBOM is meant to pair composition data with verification results, such as scans, policy checks, signatures, or other attestations.
This matters because a Software Bill of Materials (SBOM) can show dependencies, but it does not prove they were reviewed or validated. Attackers exploit that gap when organizations trust upstream software without enough proof of provenance or verification. A TBOM aims to strengthen supply chain security by helping defenders distinguish mere visibility from real assurance. In a defensive workflow, it could be used during release, deployment, or reuse to show that a component was examined under defined controls. The idea is still evolving, so the exact data model and workflow may differ across implementations.