SBOM & Dependency Management

A Software Bill of Materials (SBOM) is a complete inventory of all components, libraries, and dependencies within a software application. Analogous to a food product's ingredient list, an SBOM provides transparency into what your software contains – and which known vulnerabilities are present in those components.

Without an SBOM, organisations cannot answer a fundamental security question: if a critical vulnerability is disclosed in an open-source library, are we affected? With an SBOM, the answer is immediate. With continuous monitoring, the answer arrives automatically – before security teams even need to ask.

The EU Cyber Resilience Act (CRA) requires manufacturers of products with digital elements to provide a machine-readable SBOM. NIS2 mandates supply chain security measures. The US Executive Order 14028 requires SBOMs for software delivered to federal agencies.

These requirements are converging: organisations supplying software to regulated industries or critical infrastructure are increasingly required by contract to provide SBOMs as part of vendor security onboarding. We help you meet these requirements efficiently – with automated processes that integrate into your existing build pipelines rather than creating parallel manual workflows.

CycloneDX is the format recommended by the Cyber Resilience Act and OWASP, with a strong focus on security applications: CVE matching, VEX (Vulnerability Exploitability eXchange), and licence compliance are natively integrated. SPDX (Software Package Data Exchange) is the older ISO standard with broad open-source adoption – and frequently a requirement for vendors supplying US federal agencies.

We produce SBOMs in both formats and support conversion between standards, depending on your target audience and regulatory requirements. Organisations with mixed requirements – security-focused internally, compliance-focused for customers – typically need both.

A one-time SBOM is not enough. Dependencies change; new vulnerabilities are disclosed continuously. Our SBOM-as-a-Service provides continuous monitoring: as soon as a vulnerability is published for one of your components, you are notified – with a risk assessment and recommended action.

This transforms SBOM from a compliance checkbox into operational security intelligence. Instead of discovering that your product was vulnerable after an incident, you receive proactive notification with enough context to prioritise and act. For organisations with ISO 27001, NIS2, or CRA obligations, this turns vulnerability management from a reactive scramble into a systematic process.