Postmarket SBOM Monitoring & VEX Automation
Operational postmarket cybersecurity for cleared medical devices: continuous SBOM diffing against NVD/CISA-KEV/OSV, automated VEX triage, CVE-to-patient-harm risk scoring, and CAPA-ready evidence packs - aligned with FDA postmarket guidance, ANSI/AAMI SW96, and ISO 14971 risk management.
The short answer
What is postmarket SBOM monitoring and VEX?
Postmarket SBOM monitoring means checking every component in a cleared device's SBOM against new vulnerability data, such as CISA's list of exploited vulnerabilities, as it's published. VEX (Vulnerability Exploitability eXchange) statements record whether each vulnerability actually affects your device and why. Together they show the FDA and hospital customers that you track and triage vulnerabilities continuously, with evidence your CAPA process can use.
275+ FDA submissions supported, zero cybersecurity rejections.
- Senior team
- Fixed-fee
- Reviewer-ready
- Re-test included
- Free 30-min call
- No obligation
- Senior expert, not a sales rep
- Fixed-fee quote in 24 hours
- NDA available on request
Fixed-fee engagement
Postmarket SBOM and VEX monitoring: deliverables, inputs, and exclusions
Included work is defined in the signed proposal. These scope options are not automatic inclusions in every engagement.
Fixed-fee deliverables
- Agreed SBOM version/difference review and component vulnerability monitoring for named product releases.
- Human-reviewed applicability/triage records, evidence-supported VEX drafts where selected, and links to manufacturer risk/CAPA decisions.
Required inputs
- Versioned SBOMs and release/build records, supplier/component support information, device architecture, and vulnerability handling process.
- Manufacturer hazard context, named risk/release owners, access restrictions, and approval criteria for VEX statements.
Exclusions and separate work
- An upstream advisory is not a confirmed device finding. VEX status cannot be assigned without supporting evidence. Patching, release approval, penetration testing, and new submission documents require separate agreement.
- General software verification and validation, clinical performance testing, and full QMS implementation or certification are outside Blue Goat's product cybersecurity scope.
- The manufacturer retains engineering changes, clinical-risk evaluation, risk acceptance, release approval, and regulatory submission decisions. No regulatory outcome is promised.
Pricing and scope changes
A written fixed-fee quote after scoping. The proposal names deliverables, versions, assumptions, required inputs, exclusions, and agreed dates. Additional work requires a separately agreed scope change. Missing inputs, access restrictions, manufacturer fixes, and review feedback can affect delivery.
What continuous SBOM + VEX monitoring covers
Postmarket SBOM monitoring is more than re-running a generator. The pipeline produces a fresh inventory per release, correlates it against current CVE feeds, produces VEX statements for each affected component, and feeds the postmarket plan SLAs.
- 01Build-time SBOM generator (CycloneDX 1.5 / SPDX 2.3)
- 02Release-to-release SBOM diff
- 03CVE feeds (NVD, OSV.dev, GHSA, vendor advisories)
- 04KEV + EPSS enrichment
- 05VEX statement authoring + publication (CSAF 2.0)
- 06Triage workflow + reviewer queue
- 07Customer notification path
- 08QMS evidence pack
Layers shown outermost (top) to innermost (bottom). Dashed rows are part of the surrounding system but out of scope for this view.
Reviewer-ready deliverables in one engagement
Every engagement ships with documented artifacts, traceable, complete, and aligned with current guidance.
- Continuous SBOM ingestion (SPDX 2.3 / CycloneDX 1.5+) and diff-on-build
- Automated VEX (Vulnerability Exploitability eXchange) statements per CVE
- CVE-to-patient-harm risk scoring traced into ISO 14971 risk file
- CISA-KEV, NVD, OSV, GitHub Advisory feed monitoring
- CAPA-ready evidence packs with auditor-grade traceability
- FDA postmarket cybersecurity report draft for material changes
Public postmarket cybersecurity history
Recalls, CISA ICS-MA advisories, and disclosed research that shape what reviewers ask about, and what this engagement is built to cover.
- curl maintainers + NVD·2023
curl CVE-2023-38545 SBOM stress test
A single library disclosure that touched essentially every connected device. Teams without continuous SBOM + VEX could not answer 'are we affected' inside the FDA's expected response window.
Advisory - GitHub + Sonatype·2022-2024
PyPI / npm typosquatting supply-chain incidents
Ongoing supply-chain incidents make package-provenance and version pinning a postmarket-monitoring concern, not just a build-time one. The pipeline must flag dependency drift between releases.
Postmarket SBOM Monitoring & VEX Automation FAQs
Cybersecurity alerts and guides
Goat's Weekly alerts
Medical device advisories and safety communications, with links to original sources. An alert is a reason to assess applicability, not proof that your device is affected.
Threat modeling, eSTAR 7.1, and SBOM evidence
Connect threats to controls and test evidence. Compare the CISA 2026 SBOM fields with the NTIA 2021 baseline the FDA still cites, plus its support fields. Guidance recommendations remain separate from statutory duties.
Postmarket SBOM + VEX monitoring for Section 524B.
Operational postmarket cybersecurity for cleared medical devices: continuous SBOM diffing against NVD/CISA-KEV/OSV, automated VEX triage, CVE-to-patient-harm risk scoring, and CAPA-ready evidence packs - aligned with FDA postmarket guidance, ANSI/AAMI SW96, and ISO 14971 risk management.