SBOM

Bring your software bill of materials onto the thread — import CycloneDX or SPDX, track components and vulnerabilities, and trace components to the work that depends on them.

Import CycloneDX or SPDX and every component becomes a first-class item — linked to the risks it threatens and the tests that cover it, with CVE and CVSS tracking so you can see which components carry known vulnerabilities. Your supply chain becomes part of the same connected record as everything else.

This section covers importing an SBOM, working with components and vulnerabilities, and governing your supply chain with license policies, and how suspect works on components.

The supply chain on the same thread as everything else

A software bill of materials is often treated as a document that lives apart from engineering — generated at build time, filed away, and consulted only when a vulnerability makes the news. traceunified brings it onto the thread. Import a CycloneDX or SPDX SBOM and every component becomes a first-class item in the same connected record as your requirements, tests, and risks — linked to the risks it threatens and the verification that covers it, not stranded in a separate list.

Components, vulnerabilities, and CVE tracking

Once components are real items, vulnerability management becomes traceable. Each component carries its CVE and CVSS information, so the security posture of your supply chain is visible in context: you can see not just that a component has a known vulnerability, but which parts of your system depend on it and what that means for risk. License policies and attestation extend the same governance to the legal dimension of the supply chain.

Triage on the thread

When a vulnerability is matched to a component, the CVE appears on that component, and because components are linked into the thread you can follow those links to the risks, requirements, and tests that depend on it — a specific list of what to re-examine rather than a manual hunt through a static SBOM. A newly matched CVE does not by itself flag anything suspect; triage is deliberate. Suspect itself works on components as it does everywhere else, through your trace rules.

What’s in this section

Was this helpful?