Skip to content

Platform Overview

SBOM360 is a security and compliance platform that helps organizations manage the software supply chain behind the products they build, buy, and ship. Instead of tracking software components, vulnerabilities, and vendor communication across spreadsheets and email threads, everything happens in one place: submitting and scanning Software Bills of Materials (SBOMs), triaging vulnerabilities, exchanging Vulnerability Exploitability eXchange (VEX) statements, and notifying affected customers.

The platform brings together three groups of people:

  • Organizations — security and compliance teams who manage products, track vendors and customers, triage vulnerabilities, and send vulnerability notifications.
  • Vendors / Suppliers — companies who supply software components or products to an organization. Vendors submit SBOMs for the products assigned to them, respond to vulnerability alerts, and submit VEX statements.
  • Customers — organizations or individuals who deploy an organization's products. Customers register their deployments, receive vulnerability notifications, and request VEX assessments.

Note

Every instruction in this manual reflects a feature that exists in the platform today. Wherever a feature is described, it is available to the relevant type of user.

What you can do on SBOM360

Area What it covers
SBOM Management Upload, scan, and version Software Bills of Materials in CycloneDX and SPDX formats; link SBOMs to products; review component and vulnerability counts.
Vulnerability Management Automated vulnerability scanning of every SBOM, a triage queue with CVSS/EPSS/KEV risk signals, assignment, and status tracking.
VEX Exchange Bidirectional Vulnerability Exploitability eXchange — customers ask whether a CVE affects a deployed product, vendors and organizations respond with an official VEX assessment.
Notifications Vulnerability alerts to customers and vendors, tracked from sent through to acknowledgment.
Relationship Management Invite and manage vendors, register customers, assign products, and record customer deployments.