Software composition analysis and SBOM
SCA & SBOM articles
Open-source dependencies, their known vulnerabilities and licences, and the bill of materials that records what actually shipped.
Software composition analysis (SCA) finds known vulnerabilities and licence issues in open-source dependencies; a software bill of materials (SBOM) records identified components for a build. These articles cover what an SBOM must contain, CycloneDX versus SPDX, VEX, what SCA and SBOM each answer, and how to tell which images shipped a new CVE using retained inventory and additional analysis when needed.
- SBOM diff: review what changed before a releaseUse an SBOM diff to review added, removed and changed dependencies, preserve component identity and distinguish inventory gaps from release changes. · Sujan Singh
- What is an SBOM? Formats, generation and VEX explainedLearn what an SBOM contains, how CycloneDX and SPDX differ, where to generate one, and how VEX communicates product-specific vulnerability assessments. · Sujan Singh
- New CVE response: use SBOMs to find which images shipped itUse retained SBOMs and workload links to investigate which images contain a newly disclosed vulnerability, then identify gaps that need further scanning. · Sujan Singh
- SCA vs SBOM: what each answers and why you need bothSCA tells you which components are vulnerable today; an SBOM records what shipped. Learn how SCA and SBOM work together to answer advisory questions. · Sujan Singh
See it on your stack
See connected security in action.
Explore the workflow with your engineering, security and compliance teams. No repository access is needed for the initial demonstration.