domains / families / security / analyzing-sbom-for-supply-chain-vulnerabilities

analyzing-sbom-for-supply-chain-vulnerabilities

separate

'Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON

When to use

• A new regulatory requirement (EO 14028, EU CRA) mandates SBOM analysis for software deliveries
• Security team needs to assess third-party risk by scanning vendor-provided SBOMs
• CI/CD pipeline requires automated vulnerability checks against generated SBOMs
• Incident response needs to determine if a newly disclosed CVE affects deployed software
• Procurement team requires supply chain risk assessment for a software acquisition

When not to use

• runtime vulnerability scanning of live systems
• container scanning
• host-based vulnerability scanning

Skill page

Source