cyclonedx
1 post · all writing
The SBOM you ship is half an answer: pairing CycloneDX with VEX
An SBOM tells your customers what you are made of. Left on its own, it also hands them a list of every CVE they can match against you, and no way to tell which ones matter. The other half is VEX, and most of it is already in your descriptor.