Resources

SBOMs, VEX and supply-chain security, explained

Written to be clear for a non-technical visitor and accurate for a security engineer.

Explainers

Background reading for anyone who has been handed an SBOM and asked what to do with it.

Explainer · 5 min read

What is an SBOM?

A Software Bill of Materials is a complete, machine-readable list of everything inside a piece of software. Here is what it contains, why it exists, and what it is actually good for.

Read more
Explainer · 6 min read

What is VEX, and why does it matter?

A vulnerable component does not automatically mean a vulnerable product. VEX is how that distinction gets stated formally — instead of being argued over email.

Read more
Explainer · 7 min read

Software Supply-Chain Security explained

Your software is built from other people's software. Supply-chain security is the practice of knowing what you inherited, what is wrong with it, and who needs to be told.

Read more
Also here

Reference material

Glossary

SBOM, CVE, VEX, SPDX, CycloneDX, triage and the rest of the vocabulary, defined in one place.

Learn more

FAQ

The questions we are asked most often about SBOMAtlas and about SBOMs in general.

Learn more

Platform Documentation

The full SBOMAtlas documentation portal, for teams already using the platform.

Learn more

Still have questions about SBOMs or VEX?

A short conversation is usually faster than more reading.

Talk to an Expert Request a Demo