SBOM Observer Use Cases
Empower Your Software Security
SBOM Management
Understanding your software components and what risk they bring is paramount. SBOM Observer offers insights into your supply chain and provides up-to-date and relevant information, providing trust and compliance.
- Importing SBOMs
- Store your SBOMs or those provided by your suppliers and vendors in a structured way. We provide APIs as well as complete integrations for major CI/CD platforms such as GitHub Actions, enabling an automatic process without manual intervention.
- Exporting SBOMs to Customers and Regulators
- Facilitates distribution of SBOMs, with VEX information, to customers and other parties such as authorities. This ensures transparency that is crucial for building trust with customers and ensuring compliance with regulatory standards.
- Format Compatibility
- We support multiple industry-standard formats like CycloneDX, SPDX, OpenVEX, and SLSA. This wide-ranging compatibility allows for seamless integration with a variety of existing tools and vendors.
SBOM Management
An Attestation Workflow
Ingest, Enrich, and Share SBOM, SLSA and other attestations types across your organization.
- Attestation Inbox
- Effortlessly receive SBOMs from your suppliers and partners through a variety of channels, including email. With a single, unified inbox, you can efficiently verify and automate these imports.
- Not only SBOMs
- With native support for SLSA attestations, you can monitor and enforce provenance and other claims for your software.
- Share with your customers
- Export and share aggregated SBOMs with your customers and Vulnerability Exploitability eXchange (VEX) and vulnerabilities.
Software Composition Analysis
Open Source Inventory
Automatically identify the open source components in your software and any associated vulnerabilities or risks.
- Integrated with your CI/CD
- Smoothly integrate your CI/CD pipeline and automate the process of generating and importing up-to-date SBOMs for each build and release.
- Open Source Risk Management
- Open Source components make up 85-90% of the codebase in many modern applications and provide a significant threat surface.
Operational Model
Organize Your Inventory
Connect how you actually view services, applications and teams with your inventory of components. Remove noise by prioritizing vulnerabilities and policy violations in applications that are actually running in production.
- Track what is running in production
- Immediately know what environments are impacted by a specific vulnerability.
Vulnerability Management
Continuous Vulnerability Scanning
Your inventory of application, services and containers are continuously scanned for vulnerabilities. Integrations with OVS, GitHub Advisories, NVD and other sources ensure a comprehensive coverage of new vulnerabilities.
- Resolve issues in production first
- Leverage the operational model to prioritize vulnerabilities and policy violations in production environments first.
- Vulnerability Exploitability eXchange (VEX)
- Keep track of exploitability risk assessments for vulnerabilities using VEX documents. Create, import and share CISA VEX compliant documents with your customers and vendors.
Vulnerability Management
Container Security
Analyze and monitor your container inventory for vulnerabilities and compliance issues.
- Vulnerability Scanning
- Broad coverage of vulnerability advisories for 15+ OS distributions.
- Base Images Analysis
- Identify public and custom base images for easy attribution and remediation of vulnerabilities.
- Image Layer Analysis
- Attribute vulnerabilities and compliance issues to specific layers in the image to help you understand the impact and remediation options.
Compliance
Automated Policies
SecOps and compliance professionals can leverage the powerful policy engine to monitor and enforce policies throughout the SDLC, including services deployed in production environments.
- Cover the Entire Operational Model
- Policies cover the entire operational model including vulnerability remediation.
- Policy as Code
- The policy engine is integrated with Open Policy Engine (OPA) and SecDevOps engineers can, in addition to our visual policy builder, leverage existing skill sets and implement policies directly in Rego or JavaScript.
- License Compliance
- Automatically track license compliance issues and restrict problematic or unlicensed packages.
Let's connect!
Elevate your approach to software bill of materials management with our innovative tool. Connect with us today.
- Complete SBOM Management
- Ingest, Enrich & Share SBOMS
- Support for 25+ ecosystems
- Integrates with your CI/CD
- Uniquely connects Operational models
- Commercially Supported
A Full Stack SBOM Platform
- SBOM Management
- Create, Import, Share and Manage SBOMs throughout the software development lifecycle. Full support for standards such as CycloneDX, SPDX, VEX.
- SLSA Support
- While SBOMs provide you with an inventory, SLSA (Supply-chain Levels for Software Artifacts) enables you to track artifact integrity, that the source code you’re relying on is the code you’re actually using, across your software supply chain.
- Vulnerability Detection
- Detect known vulnerabilities in your inventory of applications, components and containers across wide selection of ecosystems. We integrate many of the standard advisory databases, including GitHub, OSV and NVD.
- Exploitability Analysis (VEX)
- Triage and add vulnerability explotability analysis ('Is this exploitable in this particular application?') to detected vulnerabilities, and share findings with your customers.
- Policy-driven Compliance
- Codify your security and quality policies and enforce them across your entire SDLC with a powerful Policy Engine based on Open Policy Engine (OPA).
- Policy as Code
- In addition to our visual policy builder, DevSecOps professionals can leverage their existing skill set and drop down to Rego or JavaScript when implementing policies.
- Operational Model
- Connect your organizations internal view of teams, services, applications, containers and deployments with the inventory provided by SBOMs and other tools.
- Track Releases
- Track deployments of releases to production environments in the operational model and leverage that information in policies - reducing the noise and helping prioritization of vulnerabilities and violations.
- CI/CD
- Easily integrate your CI/CD pipeline using popular tools and our broad support for SBOM standards and ready made solutions (e.g. GitHub Actions or using our API).
- Automatic Discovery of Applications
- Automatically synchronize your operational model integrations for Kubernetes and AWS ECS, making sure you have an up to date picture of what is running in production. (On the roadmap)
- Exploit Prediction Scoring
- Use the Exploit Prediction Scoring System (EPSS) in combination with the Operational Model and other threat signals to prioritize remediation of detected vulnerabilities.
- CISA VEX
- Create and share CISA compliant Vulnerability Exploitability eXchange (VEX) data to communicate the exploitability of vulnerable components in the context of the product customers or partners are using.
- API Integration
- Use the API for integration with SBOM Observer in your pipelines and to automate workflowsOur API is compatible with the
Pricing
Pricing plans for teams of all sizes
Choose a plan that matches your team size, support and capacity needs.
Professional
The essentials for small teams.
49 EUR/user/month
Up to 10 users
- Full stack SBOM management
- 1 Namespace
- 1 Environment
- 2 Projects
- 2 Business Days Support
- Fully Managed (SaaS)
Business
For DevSecOps and Compliance teams.
69 EUR/user/month
For 10+ users
- Full stack SBOM management
- 1 Namespace
- 3 Environments
- 10 Projects
- 1 Business Day Support
- Fully Managed (SaaS)
Enterprise
Dedicated support and infrastructure for multiple teams.
Let's talk
For 25+ users
- Full stack SBOM management
- Unlimited Namespaces
- Unlimited Environments
- Unlimited Projects
- SAML integration
- Role Based Access Controls (RBAC)
- Audit Logs
- Service Level Agreement
- Prioritized support with dedicated support channels
- Fully Managed (SaaS) or On-Premises
Frequently Asked Questions
Can’t find the answer you’re looking for? Reach out to our customer support team.
- Can I integrate my current SCA tool with SBOM Observer?
- Absolutely! SBOM Observer is compatible with most SCA tools, supporting SBOMs in CycloneDX and SPDX formats.
- Is SBOM Observer an alternative to my existing vulnerability scanner?
- Yes, it can be. Our platform detects vulnerabilities across various programming languages and operating systems. Also, unique to our service is the ability to deep-dive into Docker containers, identifying vulnerabilities and pinpointing the exact origin. For further details, visit our Ecosystem Coverage page.
- How does SBOM Observer assist with compliance for application dependency transparency?
- SBOM Observer streamlines compliance with internal policies, regulations, and customer agreements, managing both your internal and external SBOMs. For more on how we can meet your specific needs or to book a demo, reach out to our Support Team.
- What are Namespaces, Environments, and Projects in SBOM Observer?
- Namespaces in SBOM Observer are secure containers organizing SBOMs, policies, and access controls by organizational units or purposes. Environments represent deployment setups like VMs or clusters, tailored for various stages such as production or testing. Projects categorize related security components under specific products or teams.
- Is SBOM Observer Open Source?
- Not at the moment. We're considering an Open Source version in the future.
- Do you offer bulk purchase discounts?
- Yes, we provide volume discounts for organizations with multiple users. Discuss your needs with our Customer Success Team.
- Is on-premise deployment available for SBOM Observer?
- Yes. For more details, contact our Customer Success Team.
Product Development Roadmap
Upcoming features
SBOM Observer is developed continuously, and we're eager to give you a glimpse into our plans. Our high-level roadmap showcases the milestones we've reached, the new capabilities we're actively working on, and the exciting features we have in mind.
Curious about something or have ideas? Get in touch - we're all ears!
On the Horizon
Planned initiatives from our development backlog
- Azure DevOps Tasks for simplified CI/CD workflow integration
- Advanced automation features ('if this, then that' logic)
- Signing and verification processes for signed attestations
- Seamless Kubernetes integration with auto-import functionality
Next in Line
Features currently in development
- Sharing SBOMs with customers and stakeholders
- Extended capabilities for policy management
- CSAF VEX support
Current release
Provides a full SBOM management suite
- Container analysis
- OSSF Scorecard integration
- Ingest, enrich and export SBOMs (including VEX)
- Support for both CycloneDX and SPDX standards
- SLSA attestation support for enhanced security
- Compatibility with over 25 ecosystems for extensive vulnerability notification
- Graphical visualization for impact analysis of vulnerabilities
- Advanced Policy engine to reduce the number of vulnerabilities to the ones requiring attention
- Robust data model built for complex application landscapes at scale