A component inventory is a record of the parts present in a software product, including libraries, modules, packages, and other dependencies. It tells defenders what software was built into an application and often where each piece came from. In practice, this is the core idea behind an SBOM, or software bill of materials.
Component inventories matter because security teams cannot protect software they cannot identify. If a vulnerable library is listed in the inventory, defenders can quickly check which products are affected, whether a patch is needed, and whether multiple systems share the same dependency. Attackers also benefit when inventories are missing or outdated, because hidden or unknown components are harder to monitor and patch. A good inventory supports vulnerability management, supplier review, and incident response by turning an opaque product into something teams can inspect and compare.