RISK-AWARE SOFTWARE SUPPLY CHAIN SECURITY FOR AVIATION SYSTEMS USING SBOM

Aviation software now relies on large numbers of third-party components and is often deployed across several cloud providers, which increases software supply-chain risk during OTA releases. This study builds an SBOM-based method for screening container images in a multi-cloudDevSecOps setting and applies it to a test system with 128 microservices running on three cloud providers. SBOM files in CycloneDX format, OSV vulnerability records, and rule-based blocking are combined to stop images that contain high-severity components before they reach OTAstaging. The results show clear gains: the average exposure time for known high-severity vulnerabilities falls from 21 days to 3.2 days, the rate of unsafe deployments decreases by 85.7%, and the OTA gate reaches 98.9% accuracy. These findings show that SBOM checks can provide practical supply-chain protection for aviation-related OTA releases in large multi-cloud systems. Remaining limits include incomplete coverage of forked libraries and changes in CVE metadata. Future work can expand the method to other service types and link SBOM checks with runtime monitoring