Log4Shell exposed a hard truth: without an SBOM, teams may not know what's actually in their software.