Paste your previous and current SBOMs. Get the component delta, name-based attention hints, and an unresolved CycloneDX VEX draft for your team to complete with evidence.
Reviewed by
Christian Espinosa
Founder & CEO, Blue Goat Cyber
SPDX (tag-value or JSON) or CycloneDX JSON.
Same format ideally; mixed formats are fine.
What you'll see after you submit
Common misconceptions
Myth: A new SBOM each release is enough.
Reality: Reviewers and customers care about deltas. Why did this component appear, why did this version bump, and what's the VEX disposition for newly surfaced CVEs?
Myth: VEX is a one-time document.
Reality: Update vulnerability assessments as evidence changes. VEX can communicate assessments, but the FDA does not require a VEX stream.
Myth: If a component isn't on KEV it doesn't matter.
Reality: KEV is a floor, not a ceiling. EPSS, vendor advisories, and your own threat-model context all feed the disposition.
References & further reading
Tracked signals that change what reviewers expect. Items move on as new ones land.
CISA adds use-after-free in Linux kernel netfilter to KEV (CVE-2026-0511)
BLE pairing bypass in widely embedded Bluetooth stack added to KEV
CycloneDX 1.6.1 errata - clarifies VEX status semantics for medical devices
SLSA v1.1 published - tightened build-provenance language for regulated industries
Build the pipeline that produces a clean diff every release.
Read Medical device SBOM servicesHow does your SBOM + supply-chain program score overall?
Read SBOM Readiness scorerScore any individual dependency before you accept it.
Read Component Risk ScorecardPCCP, §524B checker, threat model, wireless profiler.
Read More tools