SBOM
Your supply chain, on the same thread.
Import CycloneDX or SPDX and every component becomes a first-class item — linked to the risks it threatens and the tests that cover it, with CVE and CVSS tracking so known vulnerabilities are visible on the component. The supply chain joins the same connected record as everything else.
A component as a governed record — package URL, supplier, SPDX license and integrity hash, reviewed and approved like any other item.
What it does
The supply chain, no longer a document apart.
An SBOM is usually filed away and consulted only when a vulnerability makes the news. Here it is on the thread — traceable, governed, and live.
CycloneDX & SPDX import
Import a standard SBOM and every component becomes a first-class item in the same connected record as your requirements, tests, and risks.
CVE & CVSS tracking
Each component carries its vulnerability information, so the security posture of your supply chain is visible in context — and tied to what depends on it.
License policy & attestation
The same governance extends to the legal dimension of the supply chain, with license policies and attestation.
Suspect on components
Components use the same trace-rule suspect behaviour as the rest of the thread. A newly matched CVE does not flag anything on its own — you triage it, following the component’s links to what depends on it.
On the thread
A CVE points at what to re-examine.
Because components are linked into the thread, a component’s links point straight at the risks, requirements, and tests to re-examine when a vulnerability is matched — FDA-cybersecurity-relevant capability, built in.
A component inventory can be proposed from the model, then completed by a human.
Components can be linked to the risks they introduce, so supplier and cybersecurity risk is assessed on the same thread.
Components link to the verification that covers them, so security posture ties back to evidence.
Derive with AI
Derive a component inventory from your model.
The governed derivation engine proposes an SBOM component inventory from your architecture — it builds the structure and cites its sources, but it will not fabricate versions, hashes, suppliers, or licenses. You supply those facts and accept.
Govern your supply chain like everything else.
Bring your SBOM onto the thread — tracked, traced, and ready to triage when a vulnerability is matched.