--- title: "An Analysis of Generative AI: How to Be Confidently Wrong" description: An experiment testing how well ChatGPT summarized the National Cybersecurity Strategy document and provided insights into its contents. image: https://blog.adolus.com/hubfs/Robot%20Interpretation.png --- [![aDolus Logo](https://adolus.com/images/adolus-white-new60px.webp)](https://adolus.com/) [Blog](https://blog.adolus.com/) Product - ##### Fact Platform - [Overview](https://adolus.com/fact/overview/) - [Benefits](https://adolus.com/fact/benefits/) - [Technical Details](https://adolus.com/fact/technical/) - ##### Fact Features - [Software Validation & Scoring](https://adolus.com/product/software-validation-scoring/) - [SBOM Creation](https://adolus.com/product/sbom/) - [VEX Documents](https://adolus.com/product/vex-documents/) - [Malware Detection](https://adolus.com/product/malware-detection/) - [Certificate Validation](https://adolus.com/product/certificate-validation/) - [Software Supplier Discovery](https://adolus.com/product/software-supplier-discovery/) Solutions - ##### By use case - [Vulnerability Management](https://adolus.com/solutions/vulnerability-management/) - [Compliance](https://adolus.com/solutions/compliance/) - [Risk Management](https://adolus.com/solutions/risk-management/) - [Operational Insights](https://adolus.com/solutions/operational-insights/) - ##### By job function - [Product Managers](https://adolus.com/solutions/product-managers/) - [Security Managers](https://adolus.com/solutions/security-managers/) - [Engineering Managers](https://adolus.com/solutions/engineering-managers/) - [Procurement Managers](https://adolus.com/solutions/procurement-managers/) - ##### By role in the supply chain - [Vendors & OEMs](https://adolus.com/solutions/vendors-oems/) - [Asset Owners](https://adolus.com/solutions/asset-owners/) Resources - ##### A Deeper Dive - [Blog](https://blog.adolus.com/) - [Videos & Podcasts](https://adolus.com/resources/video-podcasts/) - [Infographics](https://adolus.com/resources/infographics/) - [FAQ](https://adolus.com/resources/faq/) - [Document Library](https://adolus.com/resources/document-library/) - ##### Educational Tools - [Executive Order 14028 Timeline](https://info.adolus.com/eo14028-timeline) - [Log4j Resources](https://adolus.com/vulnerabilities/log4j/) Company - [About Us](https://adolus.com/company/about/) - [Our Partners](https://adolus.com/company/partners/) - [News](https://adolus.com/company/news/) - [Careers](https://adolus.com/company/careers/) - [Contact aDolus](https://adolus.com/company/contact/) [Get a Demo](https://info.adolus.com/schedule-a-fact-demo-3) [Regulatory Requirements](https://blog.adolus.com/tag/regulatory-requirements) [Vulnerability Tracking](https://blog.adolus.com/tag/vulnerability-tracking) # An Analysis of Generative AI: How to Be Confidently Wrong By [Marcello Delcaro](https://blog.adolus.com/author/marcello-delcaro) on April, 11 2023 [Back](https://blog.adolus.com) An Analysis of Generative AI: How to Be Confidently Wrong Share [mailto:?subject=Check%20out%20https://blog.adolus.com/how-to-be-confidently-wrong%20&body=Check%20out%20https://blog.adolus.com/how-to-be-confidently-wrong&media=https://6687498.fs1.hubspotusercontent-na1.net/hubfs/6687498/Robot%20Interpretation.png](mailto:?subject=Check%20out%20https://blog.adolus.com/how-to-be-confidently-wrong%20&body=Check%20out%20https://blog.adolus.com/how-to-be-confidently-wrong&media=https://6687498.fs1.hubspotusercontent-na1.net/hubfs/6687498/Robot%20Interpretation.png) [Back to main blog](https://blog.adolus.com) Share [mailto:?subject=Check%20out%20https://blog.adolus.com/how-to-be-confidently-wrong%20&body=Check%20out%20https://blog.adolus.com/how-to-be-confidently-wrong&media=https://6687498.fs1.hubspotusercontent-na1.net/hubfs/6687498/Robot%20Interpretation.png](mailto:?subject=Check%20out%20https://blog.adolus.com/how-to-be-confidently-wrong%20&body=Check%20out%20https://blog.adolus.com/how-to-be-confidently-wrong&media=https://6687498.fs1.hubspotusercontent-na1.net/hubfs/6687498/Robot%20Interpretation.png) The recent release of the National Cybersecurity Strategy document by the White House prompted me to test Microsoft's new Bing chat feature, which is powered by OpenAI's language model, ChatGPT. This model responds to user prompts and learns from previous interactions to provide relevant answers. My experiment aimed to test how well it could summarize the document and provide insights into its contents. ## The First Conversation   ![Author Marcello Delcaro](https://lh4.googleusercontent.com/5EgNufSVfnHFHJyzmvglbPYCNNjumwiNHaozA8il09AAwmh4js83EU1bSTUF_wcimAfABjdKo1P-RNva7q-xR_VzY_mBmsI4miTFQ1q9S-g2N-4H4PXH-8VjnqwXT6oP_SoiLEiZDHIo6PH0CG9AnVY)  —  Give me a summary of the National Cybersecurity Strategy that the White House released today   ![Bing chat bubble](https://lh6.googleusercontent.com/um1u9nkN7Po12HT-x87nEaGYTekZug_q-E_F-c-UnFEaj2BaXnrfJSfdjiTv9A47IHxrb5TpG_twyLAMz6W5XnM0kcrlGP7YOagH5FS2mFhhw5iiiDRj7hxvc8y43YiVWNm4rOVrdx-Lz6A1UlsU0LI) —  The National Cybersecurity Strategy is a 38-page blueprint that outlines how the Biden-Harris administration plans to defend the U.S. from online threats. It calls for new federal regulation of critical infrastructure firms, such as energy pipelines, food companies, schools and hospitals, that are vulnerable to cyberattacks. It also calls for software makers to be held liable when their products have security flaws that hackers can exploit. The strategy aims to shift the burden of cybersecurity from individuals and small businesses to organizations that are better equipped to mitigate cyber risks ![Author Marcello Delcaro](https://lh4.googleusercontent.com/5EgNufSVfnHFHJyzmvglbPYCNNjumwiNHaozA8il09AAwmh4js83EU1bSTUF_wcimAfABjdKo1P-RNva7q-xR_VzY_mBmsI4miTFQ1q9S-g2N-4H4PXH-8VjnqwXT6oP_SoiLEiZDHIo6PH0CG9AnVY)  —  Are there any mentions of SBOMs in it?   ![Bing chat bubble](https://lh6.googleusercontent.com/um1u9nkN7Po12HT-x87nEaGYTekZug_q-E_F-c-UnFEaj2BaXnrfJSfdjiTv9A47IHxrb5TpG_twyLAMz6W5XnM0kcrlGP7YOagH5FS2mFhhw5iiiDRj7hxvc8y43YiVWNm4rOVrdx-Lz6A1UlsU0LI) —  The National Cybersecurity Strategy 2023 SBOM mentions: - It states that the administration will work with Congress to pass legislation that requires federal contractors to provide SBOMs for critical software products. - It announces that the Department of Homeland Security (DHS) will issue a rulemaking to require SBOMs for critical infrastructure sectors. - It supports the ongoing efforts of the National Telecommunications and Information Administration (NTIA) to develop a voluntary SBOM framework and standards. ![Author Marcello Delcaro](https://lh4.googleusercontent.com/5EgNufSVfnHFHJyzmvglbPYCNNjumwiNHaozA8il09AAwmh4js83EU1bSTUF_wcimAfABjdKo1P-RNva7q-xR_VzY_mBmsI4miTFQ1q9S-g2N-4H4PXH-8VjnqwXT6oP_SoiLEiZDHIo6PH0CG9AnVY) —  What about VEX?   ![Bing chat bubble](https://lh6.googleusercontent.com/um1u9nkN7Po12HT-x87nEaGYTekZug_q-E_F-c-UnFEaj2BaXnrfJSfdjiTv9A47IHxrb5TpG_twyLAMz6W5XnM0kcrlGP7YOagH5FS2mFhhw5iiiDRj7hxvc8y43YiVWNm4rOVrdx-Lz6A1UlsU0LI)  —  In the document, there are four mentions of VEX: - On page 9, under “Enhancing Software Transparency”, it says: “The Federal Government will also encourage industry adoption of tools such as Software Bills of Materials (SBOMs) and Vulnerability Exploitability eXchange (VEX) documents that can help software consumers better understand and manage their exposure to software vulnerabilities.” - On page 10, under “Improving Vulnerability Management”, it says: “The Federal Government will also support efforts to improve vulnerability disclosure practices across sectors and promote greater use of tools such as SBOMs and VEX documents that can help software consumers better assess their exposure to known vulnerabilities.” - On page 11, under “Strengthening Supply Chain Security”, it says: “The Federal Government will also work with industry partners to promote greater use of tools such as SBOMs and VEX documents that can help software consumers better understand and manage their exposure to supply chain risks.” - On page 12, under “Promoting Cybersecurity Best Practices”, it says: “The Federal Government will also encourage industry adoption of tools such as SBOMs and VEX documents that can help software consumers better understand and manage their exposure to cyber threats.” ## Mission Accomplished? WOW — I typed in three prompts and got everything I needed to know.   Or did I? Turns out VEX wasn’t mentioned anywhere in the document. Not a single time. Once I looked at the White House document more carefully, none of the sections Bing sourced even existed! This is how AI is confidently wrong and how we, as humans, are susceptible to believing the results because they sound so authoritative. So how do we save ourselves from getting tricked? Here are my suggestions: - Develop awareness of the potential for AI-generated content when consuming information. - Ensure that you have a strong understanding of your subject matter, so that you don't immediately take any words or information you come across that align with your industry knowledge as absolute truth. - Don't confuse decisive content with accurate content. If you intend to rely on the information for anything important, spend the time to verify it. - Develop a scent for AI-produced content. Generative AIs are popping up in every industry and it’s important to use the same level of discernment as we do with disinformation. Upon further investigation, I realized that Bing had looked up the definition of VEX and skewed the context of the strategy document to fit the narrative — one that it calculated would please me. While there were some implications of VEX through related vulnerability language, there was no specific mention of VEX in the document — despite Bing helpfully providing those specific quotes and page references.  ## An Attempt at Training I prompted for a follow up. ![Author Marcello Delcaro](https://lh4.googleusercontent.com/5EgNufSVfnHFHJyzmvglbPYCNNjumwiNHaozA8il09AAwmh4js83EU1bSTUF_wcimAfABjdKo1P-RNva7q-xR_VzY_mBmsI4miTFQ1q9S-g2N-4H4PXH-8VjnqwXT6oP_SoiLEiZDHIo6PH0CG9AnVY)  —  There was no mention of VEX in the document.   ![Bing chat bubble](https://lh6.googleusercontent.com/um1u9nkN7Po12HT-x87nEaGYTekZug_q-E_F-c-UnFEaj2BaXnrfJSfdjiTv9A47IHxrb5TpG_twyLAMz6W5XnM0kcrlGP7YOagH5FS2mFhhw5iiiDRj7hxvc8y43YiVWNm4rOVrdx-Lz6A1UlsU0LI)  — My apologies for the confusion. The document references “companion artifacts that can accompany an SBOM” which implies VEX documents are part of the administration’s strategy to enhance transparency and accountability in software development and distribution. The quote Bing provided did not exist and was completely made up. But at least it was polite. After a few meetings and a lunch break, I returned to chat with Bing. I noticed that every time I typed in the prompt, I received different answers, some more intelligent than others. I observed that the names of the pillars Bing referenced in the strategy document would also change, with some being incorrect or missing altogether. An example of pillar names created by Bing: | **The Five Pillars Included in the Strategy** | **The Four Pillars Bing Liked the Sound Of** | | --- | --- | | DEFEND CRITICAL INFRASTRUCTURE | Defend America’s People, Economy, and Democracy  | | DISRUPT AND DISMANTLE THREAT ACTORS | Prevent and Disrupt Malicious Cyber Activity | | SHAPE MARKET FORCES TO DRIVE SECURITY AND RESILIENCE | Build a More Secure and Prosperous Future | | INVEST IN A RESILIENT FUTURE | Advance American Leadership and Values | | FORGE INTERNATIONAL PARTNERSHIPS TO PURSUE SHARED GOALS |   | It is worth mentioning that as the day went on, Bing's responses became more specific and relevant, sometimes admitting that it did not find any mention of SBOMs or VEX in the document at all. However, it is still important to understand that AI models can sometimes paraphrase information incorrectly or infer something entirely different or out of context. In my opinion, as this technology becomes more widespread, there must always be a human in the loop to have the final say. My experiment with Bing taught me the importance of not taking information given by AI models as fact and to always follow up with additional research to verify their responses. While AI models can be helpful in providing quick answers, they can also be confidently wrong. And they can sound especially persuasive when we assume that their responses are always accurate and reliable. ## Nevertheless, AI Has Its Place While it's true that AI has its limitations and is not always accurate, it is important to recognize the many benefits of AI. With access to vast amounts of data and information, AI can provide valuable insights and analysis that would be difficult, if not impossible, for humans to replicate. Moreover, AI can also continuously learn and improve its performance over time, making it an increasingly valuable resource.   In the context of supply chain security, AI can be used to identify file-to-vulnerability associations and provide suggestions to address potential security risks. For instance, the FACT platform uses [Artificial Intelligence to monitor and correlate the hundreds of security advisories released daily](https://adolus.com/solutions/vulnerability-management/), enabling it to make targeted recommendations to our users. Without AI, this task would be a monumental manual effort. However, it’s important to note that while AI can enhance our decision-making capabilities, it should be used sensibly and with appropriate caution. We take great care to avoid creating false positives or misleading our users with misplaced confidence. To learn more about that, read my colleague's post about the S4x23 SBOM Challenge and the [scourge of false positives in vulnerability management](https://blog.adolus.com/s4x23-sbom-challenge-part-1). By combining the strengths of AI with human expertise, we can create more efficient and effective approaches to security and other complex challenges (such as creating images for blog posts… thanks DALL·E for generating the robot at the top of this post).  ![Marcello Delcaro](https://blog.adolus.com/hubfs/marcello-whitebg.png) ###### Marcello Delcaro Marcello is a software analyst and renaissance man with an extremely wide set of skills. (If we need something done, we give it to Marcello — he’ll figure it out.) Marcello manages all of our customer pilot projects and implementation projects. [Previous Post](https://blog.adolus.com/s4x23-sbom-challenge-part-3) [View All](https://blog.adolus.com) [Next Post](https://blog.adolus.com/microsoft-digital-defense-report-behind-the-scenes-creating-ot-vulnerabilities) ##### Stay up to date ##### Browse Posts Popular Recent Archive [![What is VEX and What Does it Have to Do with SBOMs?](https://blog.adolus.com/hubfs/VEX-SBOM-main-image.png)](https://blog.adolus.com/what-is-vex-and-what-does-it-have-to-do-with-sboms) [What is VEX and What Does it Have to Do with SBOMs?](https://blog.adolus.com/what-is-vex-and-what-does-it-have-to-do-with-sboms) [![Sniffing Out Fakes: From Saffron in Marrakech to Digital Certificates](https://blog.adolus.com/hubfs/Imported_Blog_Media/Eric-on-Camel-small-1024x769.png)](https://blog.adolus.com/2019/10/08/sniffing-out-fakes-from-saffron-in-marrakech-to-digital-certificates) [Sniffing Out Fakes: From Saffron in Marrakech to Digital Certificates](https://blog.adolus.com/2019/10/08/sniffing-out-fakes-from-saffron-in-marrakech-to-digital-certificates) [![A Deeper Dive into VEX Documents](https://blog.adolus.com/hubfs/Anatomy%20of%20VEX%20Documents2.png)](https://blog.adolus.com/a-deeper-dive-into-vex-documents) [A Deeper Dive into VEX Documents](https://blog.adolus.com/a-deeper-dive-into-vex-documents) [![Three Things the SolarWinds Supply Chain Attack Can Teach Us](https://blog.adolus.com/hubfs/SolarWinds%20Attack%20Infographic.png)](https://blog.adolus.com/three-things-the-solarwinds-supply-chain-attack-can-teach-us) [Three Things the SolarWinds Supply Chain Attack Can Teach Us](https://blog.adolus.com/three-things-the-solarwinds-supply-chain-attack-can-teach-us) [![Rod Campbell Joins aDolus as CEO](https://blog.adolus.com/hubfs/Rod-Campbell-CEO.png)](https://blog.adolus.com/rod-campbell-joins-adolus-as-ceo) [Rod Campbell Joins aDolus as CEO](https://blog.adolus.com/rod-campbell-joins-adolus-as-ceo) [![Harnessing FACT for Swift Cyberthreat Response](https://blog.adolus.com/hubfs/XZ%20Backdoor%20thumbnail-aspect-corrected.png)](https://blog.adolus.com/harnessing-fact-for-swift-threat-response) [Harnessing FACT for Swift Cyberthreat Response](https://blog.adolus.com/harnessing-fact-for-swift-threat-response) [![Evolving Threats and Regulations in Software Supply Chain Security](https://blog.adolus.com/hubfs/laptop-gavel.png)](https://blog.adolus.com/evolving-threats-and-regulations-in-software-supply-chain-security) [Evolving Threats and Regulations in Software Supply Chain Security](https://blog.adolus.com/evolving-threats-and-regulations-in-software-supply-chain-security) [![EU Cyber Resilience Act (CRA) Clears Penultimate Step](https://blog.adolus.com/hubfs/flags%20and%20binary.png)](https://blog.adolus.com/eu-cra-clears-penultimate-step) [EU Cyber Resilience Act (CRA) Clears Penultimate Step](https://blog.adolus.com/eu-cra-clears-penultimate-step) [![The Wretched State of OT Firmware Patching](https://blog.adolus.com/hubfs/negelct.png)](https://blog.adolus.com/the-wretched-state-of-ot-firmware-patching) [The Wretched State of OT Firmware Patching](https://blog.adolus.com/the-wretched-state-of-ot-firmware-patching) [![Microsoft Digital Defense Report: Behind the Scenes Creating OT Vulnerabilities](https://blog.adolus.com/hubfs/MDDR2-backstage-pass-featureimage.png)](https://blog.adolus.com/microsoft-digital-defense-report-behind-the-scenes-creating-ot-vulnerabilities) [Microsoft Digital Defense Report: Behind the Scenes Creating OT Vulnerabilities](https://blog.adolus.com/microsoft-digital-defense-report-behind-the-scenes-creating-ot-vulnerabilities) - [May 2024](https://blog.adolus.com/archive/2024/05) - [February 2024](https://blog.adolus.com/archive/2024/02) - [December 2023](https://blog.adolus.com/archive/2023/12) - [October 2023](https://blog.adolus.com/archive/2023/10) - [April 2023](https://blog.adolus.com/archive/2023/04) - [March 2023](https://blog.adolus.com/archive/2023/03) - [February 2023](https://blog.adolus.com/archive/2023/02) - [October 2022](https://blog.adolus.com/archive/2022/10) - [April 2022](https://blog.adolus.com/archive/2022/04) - [February 2022](https://blog.adolus.com/archive/2022/02) - [December 2021](https://blog.adolus.com/archive/2021/12) - [November 2021](https://blog.adolus.com/archive/2021/11) - [August 2021](https://blog.adolus.com/archive/2021/08) - [July 2021](https://blog.adolus.com/archive/2021/07) - [June 2021](https://blog.adolus.com/archive/2021/06) - [May 2021](https://blog.adolus.com/archive/2021/05) - [February 2021](https://blog.adolus.com/archive/2021/02) - [January 2021](https://blog.adolus.com/archive/2021/01) - [December 2020](https://blog.adolus.com/archive/2020/12) - [September 2020](https://blog.adolus.com/archive/2020/09) - [August 2020](https://blog.adolus.com/archive/2020/08) - [July 2020](https://blog.adolus.com/archive/2020/07) - [May 2020](https://blog.adolus.com/archive/2020/05) - [April 2020](https://blog.adolus.com/archive/2020/04) - [January 2020](https://blog.adolus.com/archive/2020/01) - [October 2019](https://blog.adolus.com/archive/2019/10) - [September 2019](https://blog.adolus.com/archive/2019/09) - [November 2018](https://blog.adolus.com/archive/2018/11) - [September 2018](https://blog.adolus.com/archive/2018/09) - [May 2018](https://blog.adolus.com/archive/2018/05) ##### Browse by topics - [Supply Chain Management (16)](https://blog.adolus.com/tag/supply-chain) - [SBOM (15)](https://blog.adolus.com/tag/sbom) - [Vulnerability Tracking (15)](https://blog.adolus.com/tag/vulnerability-tracking) - [#supplychainsecurity (10)](https://blog.adolus.com/tag/supplychainsecurity) - [Regulatory Requirements (10)](https://blog.adolus.com/tag/regulatory-requirements) - [VEX (8)](https://blog.adolus.com/tag/vex) - [EO14028 (6)](https://blog.adolus.com/tag/eo14028) - [ICS/IoT Upgrade Management (6)](https://blog.adolus.com/tag/upgrades) - [malware (6)](https://blog.adolus.com/tag/malware) - [ICS (5)](https://blog.adolus.com/tag/ics) - [vulnerability disclosure (5)](https://blog.adolus.com/tag/vulnerability-disclosure) - [3rd Party Components (4)](https://blog.adolus.com/tag/3rd-party-components) - [Partnership (4)](https://blog.adolus.com/tag/partnership) - [Press-release (4)](https://blog.adolus.com/tag/press-release) - [#S4 (3)](https://blog.adolus.com/tag/s4) - [Software Validation (3)](https://blog.adolus.com/tag/sw-validation) - [hacking (3)](https://blog.adolus.com/tag/hacking) - [industrial control system (3)](https://blog.adolus.com/tag/industrial-control-system) - [Code Signing (2)](https://blog.adolus.com/tag/code-signing) - [Legislation (2)](https://blog.adolus.com/tag/legislation) - [chain of trust (2)](https://blog.adolus.com/tag/chain-of-trust) - [#nvbc2020 (1)](https://blog.adolus.com/tag/nvbc2020) - [DoD CMMC (1)](https://blog.adolus.com/tag/dod-cmmc) - [Dragonfly (1)](https://blog.adolus.com/tag/dragonfly) - [Havex (1)](https://blog.adolus.com/tag/havex) - [Log4Shell (1)](https://blog.adolus.com/tag/log4shell) - [Log4j (1)](https://blog.adolus.com/tag/log4j) - [Trojan (1)](https://blog.adolus.com/tag/trojan) - [USB (1)](https://blog.adolus.com/tag/usb) - [Uncategorized (1)](https://blog.adolus.com/tag/uncategorized) - [energy (1)](https://blog.adolus.com/tag/energy) - [medical (1)](https://blog.adolus.com/tag/medical) - [password strength (1)](https://blog.adolus.com/tag/password-strength) - [pharmaceutical (1)](https://blog.adolus.com/tag/pharmaceutical) Sidebar ### Related Posts [![Harnessing FACT for Swift Cyberthreat Response](https://blog.adolus.com/hubfs/XZ%20Backdoor%20thumbnail-aspect-corrected.png)](https://blog.adolus.com/harnessing-fact-for-swift-threat-response) 6 min read ##### [Harnessing FACT for Swift Cyberthreat Response](https://blog.adolus.com/harnessing-fact-for-swift-threat-response) By [Marcello Delcaro](https://blog.adolus.com/author/marcello-delcaro) on May 1, 2024 In the cybersecurity world, anticipation and rapid response are crucial in safeguarding against emerging threats.... [Continue Reading](https://blog.adolus.com/harnessing-fact-for-swift-threat-response) [![How Russia Might Come After the West](https://blog.adolus.com/hubfs/russian-gas-pump-cyberattack-900x525.png)](https://blog.adolus.com/how-russia-might-come-after-the-west) 2 min read ##### [How Russia Might Come After the West](https://blog.adolus.com/how-russia-might-come-after-the-west) By [Eric Byres](https://blog.adolus.com/author/eric-byres) on February 25, 2022 The DDoS attack surge that began last week against Ukrainian government agencies and banks was a bad sign. I was... [Continue Reading](https://blog.adolus.com/how-russia-might-come-after-the-west) [![Unpacking EO14028: Improving the Nation's Cybersecurity - Pt. 1](https://blog.adolus.com/hubfs/Timeline-thumbnail.png)](https://blog.adolus.com/unpacking-eo-14028-improving-the-nations-cybersecurity-part-1) 4 min read ##### [Unpacking EO14028: Improving the Nation's Cybersecurity - Pt. 1](https://blog.adolus.com/unpacking-eo-14028-improving-the-nations-cybersecurity-part-1) By [Eric Byres](https://blog.adolus.com/author/eric-byres) on May 14, 2021 Late Wednesday night President Biden signed the Executive Order on Improving the Nation’s Cybersecurity. Compared to... [Continue Reading](https://blog.adolus.com/unpacking-eo-14028-improving-the-nations-cybersecurity-part-1) [![3 Month Reprieve for Utilities on Cybersecurity Supply Chain Standards](https://blog.adolus.com/hubfs/Imported_Blog_Media/NERC-CIPC-Training-Session-1024x451.jpeg)](https://blog.adolus.com/2020/04/21/3-month-reprieve-for-utilities-on-cybersecurity-supply-chain-standards) 3 min read ##### [3 Month Reprieve for Utilities on Cybersecurity Supply Chain Standards](https://blog.adolus.com/2020/04/21/3-month-reprieve-for-utilities-on-cybersecurity-supply-chain-standards) By [Eric Byres](https://blog.adolus.com/author/eric-byres) on April 21, 2020 Earlier this month, as the coronavirus accelerated its alarming sprint across North America, NERC requested that... [Continue Reading](https://blog.adolus.com/2020/04/21/3-month-reprieve-for-utilities-on-cybersecurity-supply-chain-standards) [![EU Cyber Resilience Act (CRA) Clears Penultimate Step](https://blog.adolus.com/hubfs/flags%20and%20binary.png)](https://blog.adolus.com/eu-cra-clears-penultimate-step) 5 min read ##### [EU Cyber Resilience Act (CRA) Clears Penultimate Step](https://blog.adolus.com/eu-cra-clears-penultimate-step) By [Eric Byres](https://blog.adolus.com/author/eric-byres) on December 8, 2023 On December 3rd, the EU's new Cyber Resilience Act (CRA) got a big step closer to being adopted when the European... [Continue Reading](https://blog.adolus.com/eu-cra-clears-penultimate-step) [![Podcast: Where Do Your Bits Really Come From?](https://blog.adolus.com/hubfs/Imported_Blog_Media/Dragonfly-Compromise-Stages_cropped-768x454.png)](https://blog.adolus.com/2019/09/26/podcast-where-do-your-bits-really-come-from) 3 min read ##### [Podcast: Where Do Your Bits Really Come From?](https://blog.adolus.com/2019/09/26/podcast-where-do-your-bits-really-come-from) By [Eric Byres](https://blog.adolus.com/author/eric-byres) on September 26, 2019 Earlier this year I attended the Public Safety Canada Industrial Control System Security symposium in Charlottetown,... [Continue Reading](https://blog.adolus.com/2019/09/26/podcast-where-do-your-bits-really-come-from) [![A Flurry of Regulatory Action and the Need for SBOMs](https://blog.adolus.com/hubfs/Regulatory%20Action.png)](https://blog.adolus.com/a-flurry-of-regulatory-action) 5 min read ##### [A Flurry of Regulatory Action and the Need for SBOMs](https://blog.adolus.com/a-flurry-of-regulatory-action) By [Eric Byres](https://blog.adolus.com/author/eric-byres) on October 12, 2022 Executive Order 14028 on Improving the Nation's Cybersecurity was issued in May of 2021 and provided a roadmap for a... [Continue Reading](https://blog.adolus.com/a-flurry-of-regulatory-action) [![Sorry Blackberry: You Are Part of the Supply Chain](https://blog.adolus.com/hubfs/Blackberry-SBOM-share-main-image.png)](https://blog.adolus.com/sorry-blackberry-you-are-part-of-the-supply-chain) 2 min read ##### [Sorry Blackberry: You Are Part of the Supply Chain](https://blog.adolus.com/sorry-blackberry-you-are-part-of-the-supply-chain) By [Eric Byres](https://blog.adolus.com/author/eric-byres) on November 2, 2021 Today, reporters Betsy Woodruff Swan and Eric Geller at Politico published a story: “BlackBerry resisted announcing... [Continue Reading](https://blog.adolus.com/sorry-blackberry-you-are-part-of-the-supply-chain) [![The Wretched State of OT Firmware Patching](https://blog.adolus.com/hubfs/negelct.png)](https://blog.adolus.com/the-wretched-state-of-ot-firmware-patching) 4 min read ##### [The Wretched State of OT Firmware Patching](https://blog.adolus.com/the-wretched-state-of-ot-firmware-patching) By [Eric Byres](https://blog.adolus.com/author/eric-byres) on October 11, 2023 This blog is a follow-up to our first post on the 2023 Microsoft Digital Defense Report where I described our... [Continue Reading](https://blog.adolus.com/the-wretched-state-of-ot-firmware-patching) [![NTIA Publishes Minimum Components of an SBOM](https://blog.adolus.com/hubfs/Main-SBOM-image.png)](https://blog.adolus.com/ntia-publishes-minimum-components-of-an-sbom) 4 min read ##### [NTIA Publishes Minimum Components of an SBOM](https://blog.adolus.com/ntia-publishes-minimum-components-of-an-sbom) By [Derek Kruszewski](https://blog.adolus.com/author/derek-kruszewski) on July 15, 2021 In today’s blog post I’d like to recognize all the hard work done by NTIA (National Telecommunications and Information... [Continue Reading](https://blog.adolus.com/ntia-publishes-minimum-components-of-an-sbom) ### Post a comment ### Stay up to date Subscribe to our blog ### Stay up to date ![aDolus Logo in blue](https://adolus.com/_next/image/?url=%2Fimages%2Fadolus-blue-60px.png&w=128&q=100) 200 - 535 Yates Street Victoria, BC Canada V8W 2Z6 [+1-866-423-6587](tel:18664236587) [info@adolus.com](mailto:info@adolus.com) #### Product - FACT Platform - [Overview](https://adolus.com/fact/overview/) - [Benefits](https://adolus.com/fact/benefits/) - [Technical Details](https://adolus.com/fact/technical/) - FACT Features - [Software Validation & Scoring](https://adolus.com/product/software-validation-scoring/) - [SBOM Creation](https://adolus.com/product/sbom/) - [VEX Documents](https://adolus.com/product/vex-documents/) - [Malware Detection](https://adolus.com/product/malware-detection/) - [Certificate Validation](https://adolus.com/product/certificate-validation/) - [Software Supplier Discovery](https://adolus.com/product/software-supplier-discovery/) #### Solutions - By use case - [Vulnerability Management](https://adolus.com/solutions/vulnerability-management/) - [Compliance](https://adolus.com/solutions/compliance/) - [Risk Management](https://adolus.com/solutions/risk-management/) - [Operational Insights](https://adolus.com/solutions/operational-insights/) - By job function - [Product Managers](https://adolus.com/solutions/product-managers/) - [Security Managers](https://adolus.com/solutions/security-managers/) - [Engineering Managers](https://adolus.com/solutions/engineering-managers/) - [Procurement Managers](https://adolus.com/solutions/procurement-managers/) - By role in the supply chain - [Vendors & OEMs](https://adolus.com/solutions/vendors-oems/) - [Asset Owners](https://adolus.com/solutions/asset-owners/) - [Integrators & Consultants](https://adolus.com/solutions/integrators-consultants/) - [Security Providers & Partners](https://adolus.com/solutions/security-providers-partners/) #### Resources - [Blog](https://blog.adolus.com/) - [Videos & Podcasts](https://adolus.com/resources/video-podcasts/) - [Infographics](https://adolus.com/resources/infographics/) - [FAQ](https://adolus.com/resources/faq/) - [Document Library](https://adolus.com/resources/document-library/) - Educational Tools - [Executive Order #14028 Timeline](https://info.adolus.com/eo14028-timeline) - [Log4j Resources](https://adolus.com/vulnerabilities/log4j/) #### Company - [About Us](https://adolus.com/company/about/) - [Our Partners](https://adolus.com/company/partners/) - [News](https://adolus.com/company/news/) - [Careers](https://adolus.com/company/careers/) - [Contact](https://adolus.com/company/contact/) Copyright © 2024 aDolus Technology Inc [Privacy Policy](https://adolus.com/legal/privacy-policy/) [Terms of Service](https://adolus.com/legal/terms-of-service/)