Friedman says SBOMs matter for response, not static inventories
He argues accurate supplier SBOMs speed Log4j-style response, while VEX separates vulnerable components from exploitable ones.
Stories per day · 30 days
2 RSS
Relatedsbom3software-supply-chain2vulnerability-management2ai-bom1cyclonedx1devguard1devsecops1owasp1spdx1supply-chain1syft1
5 stories, newest first · one card per story
Stories tagged #vex
DevGuard open-source platform ranks and tracks supply-chain findings
One CLI wraps six scan types, and a registry proxy can block known-malicious npm, Go, and Python packages before download.
12 Best SBOM Tools Compared (2026): Features & Pricing
A 2026 roundup ranks 12 SBOM tools, naming Anchore Syft the best free generator and FOSSA and Cybeats top managers.
6
The Unreasonable Effectiveness of Vex in NixOS
Blog post argues NixOS can automate VEX statements so teams skip unreachable CVE findings.
VEX-Bench: Benchmarking LLM Agents for Assessing Exploitability of Software Supply Chain Vulnerabilities
Introduces VEX-Bench, 75 expert-labeled real-world cases testing whether LLM agents can assess supply chain vulnerability exploitability; frontier models reach about 80% F1.