Security tools assume ideal workflows, but real adoption looks different. Based on analysis of 1,000+ SBOMs, this talk reveals how teams actually engage with supply chain security: where they disengage, what workflows persist, and how “good enough” shapes outcomes.