Your vendor's SBOM, matched against the CVEs already being exploited.

Upload a vendor's SBOM (its software component list) and HodeiShield matches it with OSV.dev, flags actively exploited CVEs (published vulnerabilities) and alerts you to critical and high severity ones. Query components and CVEs per vendor and download the original SBOM.

For: Vendor managers and CISOs who need to know which software components their third parties carry, and to gather the basis for component transparency under the CRA and NIS2.

Request a demo Read the risk engine docs

SBOMs in JSON, CycloneDX or SPDX; XML and tag-value are not accepted
Daily CVE sync; this is not real-time detection

A vendor's SBOMVendor A

Sample data

vendor-a-sbom.json

CycloneDX (JSON)412 components

Ingest
Read and stored against the vendor
Match with OSV.dev
Component by component
Alert
If critical or high
Download
The original SBOM, as you uploaded it

examplelib@2.3.1
CVE-2099-0001
Critical
In KEV Yes
parser-x@1.9.0
CVE-2099-0002
High
In KEV No
http-client@0.8.4
CVE-2099-0003
Medium
In KEV No

Alert: To the destinations you configured
Download: The original SBOM and its component inventory

Sample data: the vendor, components and CVE identifiers are fictional.

From a file to a decision

An SBOM's path in four steps, with what each one does not do.

You upload the SBOM
You upload it, authenticated, from the vendor's card: JSON in CycloneDX or SPDX, up to 10 MB.
Scope. The vendor cannot upload it from a link; XML and tag-value are not accepted.
It is matched with OSV.dev
Each component is checked against the open OSV.dev vulnerability database, and the reconciliation repeats daily to catch CVEs published later.
Scope. Daily, not real time.
The alert that matters fires
A critical or high severity CVE raises an alert tied to the vendor, routed by your rules. Actively exploited ones (KEV) weigh more in the score.
Scope. The email notice to the vendor is triggered manually.
You query and download
The components and their CVEs stay queryable per vendor, and you can download the original SBOM you uploaded.
Scope. It is component evidence, not a declaration of conformity nor a signed attestation.

What it does, with its proof and its scope

Each claim carries, in the margin, where to check it and where it stops.

Source of proof

Public documentation
Open source
In the demo

Scope: what the claim does not cover

SENSE · collect evidence

What your vendor's software contains and what is known about each component.

Authenticated upload of each vendor's SBOM in JSON (CycloneDX or SPDX), with its components stored against the vendor.1
In the demo · vendor SBOM tab
Scope. JSON only. The vendor cannot upload its SBOM from a link: you upload it.
Each component is matched with OSV.dev and the reconciliation repeats daily to catch CVEs published after the upload.2
In the demo · CVEs per component
Scope. Daily cadence; not real-time detection.

Applies inThird-party risk management

PREDICT · quantify and simulate

Which CVE deserves your attention first and how many vendors it reaches.

Actively exploited CVEs (CISA's KEV catalogue) weigh more in the vendor's score.3
Docs · Risk engine (opens in a new tab)
When a vulnerable component appears in several SBOMs you see which vendors are affected, and shared components feed the concentration analysis.4
In the demo · impact per component
Scope. Nth-party discovery from SBOMs exists but is not scheduled: it is not an automatic map.

Applies inThird-party risk management

ACT · propose and approve

What happens when a CVE affecting a vendor appears.

A critical or high CVE in an SBOM raises an alert tied to the vendor, routed by your rules to ServiceNow, Jira, Slack, Teams, email, webhook, SIEM, PagerDuty or Opsgenie.5
Docs · Connectors (opens in a new tab)
Scope. It notifies or creates the ticket in your system; it neither remediates nor patches.
The vendor responds to a CVE notice from a single-link portal, with deadlines you configure per severity.6
In the demo · responding to a CVE
Scope. The full loop of deadline, re-check and remediation evidence is partial: today the notice, the portal and deadline tracking work.

Applies inHodeiAI

ATTEST · prove it to third parties

The SBOM is not attested: it stays as downloadable evidence.

The original SBOM can be downloaded as you uploaded it, and its components and CVEs are queried per vendor.7
In the demo · SBOM download
Scope. Not a declaration of conformity nor a signed attestation. The Trust Center attestation never includes SBOM detail.

Applies inCyber Resilience Act Trust Center and ATTEST

SENSE feeds PREDICT; PREDICT prioritises what ACT proposes; ATTEST proves it to third parties.

What it does not do

So you know what an SBOM covers and what it does not.

It does not generate SBOMs: it works with the one your vendor gives you, in JSON.
It does not detect in real time: CVEs sync daily.
It is not a complete nth-party map: SBOM-based discovery exists but is not scheduled.
It does not email your vendors on its own: you trigger the send.
It neither patches nor remediates, and it does not declare CRA conformity: it provides component evidence.
The SBOM is not attested and is not part of the Trust Center attestation.

How it connects to the other solutions

The SBOM hangs off the vendor's card and ends up in your file.

Questions from whoever runs the software supply chain

The usual objections, answered as they are.

Which SBOM formats does it accept?

CycloneDX and SPDX, JSON only, up to 10 MB per upload. XML and tag-value are not accepted. The upload is authenticated: you do it from the vendor's card.

Can my vendor upload its own SBOM?

Not through a link today: you upload the SBOM, using the file the vendor gave you.

Which vulnerability database does it match against?

OSV.dev, on top of the platform's daily CVE sync (NVD, CISA KEV and EPSS, the likelihood of exploitation). Actively exploited ones, those in the KEV catalogue, weigh more in the score.

Does it alert me in real time to a new CVE?

No. The sync and the SBOM reconciliation are daily, so latency to the alert can be up to a day. Critical and high severity alerts are routed to the destinations you have configured.

Does it make me CRA-compliant?

No. It gives you each SBOM's component inventory and its CVEs, a basis for your CRA file. It is not a declaration of conformity: assessing your product's or your vendor's conformity is something you do.

Does the Trust Center attestation include the SBOM?

No. The attestation carries only per-framework maturity bands, never scores, amounts or SBOM detail.

Match one SBOM from your portfolio

In the demo we upload one of your vendors' SBOMs and walk the CVEs, the alert and the component inventory.

Demos use your data or sample data, never other customers' data.