Blue Goat CyberBlue Goat CyberSMMedical Device Cybersecurity
    All infographics
    SBOM

    PURL vs CPE at a glance

    A side-by-side comparison of PURL and CPE component identifiers for medical device SBOMs: format, who defines names, best use, and weak spots.

    Infographic comparing PURL and CPE: examples pkg:npm/lodash@4.17.21 and cpe:2.3:a:lodash:lodash:4.17.21, who defines names, best use, weak spots, and how to use both in an SBOM.
    Most medical device SBOMs need both. Map each PURL to a CPE so monitoring catches NVD advisories as well as ecosystem advisories.
    Download the graphicTalk through it with us

    What the graphic says

    The full text version, so the content is readable without the image.

    PURL

    What it is
    Package URL.
    Example
    pkg:npm/lodash@4.17.21
    Who defines names
    The package ecosystem.
    Best for
    Open-source packages.
    Weak spot
    NVD CVE matching does not use it.
    In an SBOM
    Use for every package.

    CPE

    What it is
    Common Platform Enumeration.
    Example
    cpe:2.3:a:lodash:lodash:4.17.21:*:*:*:*:*:*:*
    Who defines names
    NIST's CPE dictionary (NVD).
    Best for
    Matching CVEs in the NVD.
    Weak spot
    Often missing for small packages.
    In an SBOM
    Add where one exists.

    Keep reading

    More in SBOM

    Ready when you are

    Secure your device before it reaches patients.

    30-minute strategy session. No cost, no commitment - just answers from people who've supported 275+ FDA submissions, with zero cybersecurity rejections.

    Book strategy sessionExplore services