In 2026, surging CVE volumes and NIST’s shift in NVD enrichment have changed the premise of SBOM-based vulnerability management. Drawing on VicOne’s quarterly threat reports, this session explains how regulations differ by role, with UN-R155 for vehicle makers and the EU CRA for embedded and component suppliers, and offers three recommendations for making SBOMs a tool for rapid response.