It's not really a security tool per-se, in that it isn't designed exclusively for security use. Its purpose is to concisely and completely communicate what software components make up a project/system. You can use that information for security/licensing/regulation compliance/etc.