Suspect propagation
How suspect works for SBOM components — the same trace-rule behaviour as the rest of the thread. A newly matched vulnerability does not by itself flag anything suspect.
An SBOM that’s only checked at import is a snapshot that goes stale, and new vulnerabilities are disclosed every day. It helps to be precise about what traceunified does when that happens, and what it does not do.
What a new vulnerability does — and doesn’t
When vulnerability data is matched to a component in your inventory, the vulnerability shows up on the component (see Vulnerabilities). A newly matched CVE does not automatically flag the component, or the work linked to it, as suspect. Triage is a deliberate step: someone assesses the vulnerability, and the linked risks, requirements, and tests are reviewed through the links you’ve made.
Suspect, applied to components
Components use the same suspect mechanism as every other item on the thread. When a change is made to a field that is configured to trigger suspect (a triggersSuspect field), the links that depend on it are flagged according to your trace rule set. By default the flag goes one hop — to the directly linked items. An administrator can enable a multi-hop option so it carries further along the thread. The flag is explicit and visible, not a silent status change.
Acting on it
A suspect flag is a prompt to act: assess the change, re-verify the affected controls, and clear the flag once the work is sound again. The history of the flag and its resolution stays in the record. The general mechanics of suspect links and impact analysis are covered in Traceability.