Werkspilot
    ← Insights

    SBOM by manufacturer: what Siemens, Beckhoff, Rockwell and ten others actually provide

    In brief · As of October 2026

    With every one of the thirteen manufacturers, part of the devices hangs behind the controller where no network scan looks: EtherCAT terminals, rack modules, terminal bus, IO-Link. Which route gets them into the list is in the table per manufacturer. Nine of thirteen publish advisories as CSAF, five of them via CERT@VDE, and four only as PDF or HTML. None identifies hardware via CPE; the key everywhere is the order number, article, material, part or catalog number plus a firmware range. For the plant SBOM this means: the device list is created by the plant builder, at device level, with exactly these numbers. None of them hands out an SBOM per product freely; for the plant you do not need one.

    Thirteen manufacturers, measured on 7 Oct 2026

    All figures are our own measurements: ROLIE feeds and directories downloaded in full and counted, advisory lists without a feed counted from the HTML. Each article describes source, command and limitations.

    ManufacturerAdvisories total / new 2026CSAFProduct identifierDevices behind the controller
    Siemens841 / 81 (132 new or updated)own provider, BSI aggregatorMLFB as model_numbers; 0 CPE/PURLPROFINET I&M0 per slot, also modular devices (stage 1)
    Beckhoff17 / 2CERT@VDEsoftware packages with PURL/CPE (2026), otherwise name + versionEtherCAT terminals only via IPC and ADS (stage 3)
    B&R29 / 10ABB PSIRT feed (14 documents)name + AR version range; 0 CPE/PURLX20 modules and POWERLINK only via system diagnostics (stage 3)
    Rockwell337 / 35announced, not discoverablecatalog number + firmware in HTMLRack and adapter modules via CIP routing (stage 2)
    Schneider Electric291 / 30own provider without ROLIE, bot blockingfamily + version; M580 without helperX80 and TM3 modules via CPU diagnostics and Control Expert (stage 2)
    WAGO82 / 8CERT@VDEorder number with wildcards + FW releaseTerminal bus modules via coupler submodules (stage 1) or controller (stage 3)
    Phoenix Contact113 / 9CERT@VDEseven-digit article number + FWAxioline behind couplers via I&M0 per slot (stage 1), IO-Link via master (stage 3)
    Bosch Rexroth42 / 2none (HTML, Atom)material number R911… + versionEtherCAT devices via the CORE's Data Layer (stage 3), S20-PN via I&M0 (stage 1)
    Omron25 / 0 (1 update)none (PDF, JVN, CISA)series + unit versionEtherCAT units and servos via NJ/NX and Sysmac Studio (stage 3)
    Mitsubishi Electric~140 / 6 (CISA: 10 new)none (PDF; CISA CSAF)module type + firmware stringRack modules and CC-Link stations via GX Works3 (stage 3)
    Pilz20 / 3CERT@VDEorder number as model_numbersExpansion modules via Configurator and PAS4000 (stage 3), PROFINET module via I&M0 (stage 1)
    Festo18 / 1CERT@VDEpart number (skus) + order codeAP modules behind PN heads via I&M0 (stage 1), EtherCAT and IO-Link via master (stage 3)
    SICK71 / 13own provider, BSI aggregatorpart number (skus), often “all versions”Flexi Soft modules via Safety Designer, IO-Link via SIG master (stage 3)

    The volume is unevenly distributed: Siemens, Rockwell and Schneider Electric together publish more than the other ten combined, with Patch Tuesday bursts of eight advisories in a single day. The niche manufacturers, in turn, are the ones most often missing from device lists: safety technology from Pilz and SICK, IO-Link masters from Phoenix Contact.

    The plant's protocol determines how the device list is created

    Because manufacturers identify by order and part numbers, the device level is sufficient, and the industrial protocols deliver it out of the box. Which fields each protocol exposes and where the gaps are is covered in the protocol articles:

    • PROFINET: I&M0 with OrderID, serial number, hardware and firmware version, mandatory for every certified device; DCP finds, PNIO-CM reads.
    • EtherNet/IP: a ListIdentity broadcast delivers Vendor ID, Product Code, Revision, serial number and product name for the whole subnet.
    • EtherCAT: identity in the EEPROM and object 0x1018, readable only via the master, terminals are invisible on the network.
    • Modbus TCP: function code 43 with vendor, product code and revision, optional and without discovery.
    • OPC UA: BuildInfo per server, DI nameplate per device, controller level, not field devices.
    • SNMP: sysDescr and ENTITY-MIB for switches, routers, IPCs and PROFINET CC-B devices.
    • IO-Link: Vendor ID, Device ID and product name mandatory; serial number and firmware optional; everything via the master.

    How the methods combine per control world is described in the article on the network scan for the plant SBOM; which three to five sources feed a plant SBOM, in the article on creating the SBOM in plant engineering.

    What follows from this for the plant builder

    • Waiting for manufacturer SBOMs leads nowhere. None of the thirteen hands them out freely, and the CRA does not oblige component manufacturers to pass them on to customers. The device list of the plant, on the other hand, can be collected today.
    • CPE does not work as a key. Siemens 0 of 841, ABB/B&R 0 of 74, SICK 0, Schneider 0 in the sample; WAGO and Phoenix only on the operating system or in a few recent documents. A tool that searches via CPE checks nothing for industrial components.
    • Advisories arrive by three routes. Nine manufacturers provide CSAF, directly or via CERT@VDE and the BSI aggregator. For Mitsubishi and Rockwell, CISA provides CSAF. For Bosch Rexroth, Omron and the Rockwell archive, HTML and PDF remain. All three routes have to feed the same device list, otherwise the reporting deadline cannot be kept for suppliers without CSAF.

    Guide: the plant SBOM in five steps.

    Which sources feed the device list, which scan method reaches which devices and how matching against manufacturer advisories works without CPE, compact as a PDF with a checklist per step.

    Request the guide →

    Werkspilot continuously checks the device list of delivered plants against the advisories and CSAF feeds of the component manufacturers. The figures in this article are our own measurements from 7 Oct 2026; manufacturers change feeds and pages without notice.

    Frequently asked questions

    Everything without its own network identity: EtherCAT terminals at Beckhoff, Omron, Festo and Bosch Rexroth, X20 modules and POWERLINK devices at B&R, rack modules at Rockwell, Schneider and Mitsubishi, terminal bus modules at WAGO, expansion modules of the Pilz and SICK safety controllers, IO-Link sensors behind every master. They only get into the list via the controller or the master, with PROFINET heads as submodules with I&M0 per slot. Which route works for which manufacturer is in the table and in the respective article.

    Siemens and SICK with their own provider (both in the BSI aggregator), Schneider Electric with its own provider without a ROLIE feed, B&R via the ABB PSIRT feed, and Beckhoff, WAGO, Phoenix Contact, Pilz and Festo via CERT@VDE. Rockwell announces CSAF, but no provider can be found. Bosch Rexroth, Omron and Mitsubishi publish only HTML or PDF; for Mitsubishi and Rockwell, CISA provides CSAF documents.

    Because manufacturers do not identify hardware via CPE: Siemens uses the MLFB, Phoenix Contact the article number, WAGO order numbers with wildcards, Festo and SICK part numbers, Rockwell catalog numbers, Bosch Rexroth material numbers, each with a firmware range. CPE appears only sporadically, at Beckhoff for software packages, at WAGO and Pilz for operating systems. The device list therefore has to carry these numbers and the firmware version.