Solution 02 · Product & Supply Chain

Know which product versions a supplier change can reach.

A component list answers “what is in this build”. A supply-chain workflow answers “which shipped versions contain this supplier module, and what do we need to review now”.

Validate a supplier SBOM Contact us about Early Access

Capabilities

What this includes, and what each part really is today

Every capability carries a status. “Available now” means you can use it on this site. “Early Access” means design-partner scope. “Planned” means it does not exist yet.

SBOM validation and inventory quality

Available now

Check the inventory and identify components that cannot be matched to advisories.

Runs today in the browser for CycloneDX and SPDX JSON, with per-component reasons and exportable results.

Release-to-release comparison

Available now

See which components entered, left or changed between two firmware inventories.

The SBOM Diff compares identities and exact versions locally. It reports a version change; it does not judge whether the change is exploitable.

Supplier component traceability

Early Access

Follow a supplier module to the product versions that contain it, without flattening the origin.

Design-partner scope in the app workspace. The public site documents the workflow; it does not provide supplier accounts or a supplier portal.

Product and version security status

Early Access

Review findings per shipped version instead of per uploaded file.

Workspace-level view in design-partner scope. The current public site has no account area and does not run live monitoring.

Advisory review and recorded decisions

Early Access

Keep the applicability decision and its evidence next to the product version.

Early Access. A match is treated as a lead to review, never as confirmation of exploitability.

An inventory is not an impact analysis

Most teams can produce a component list for a build. Fewer can answer, quickly and with evidence, which shipped product versions contain a specific supplier module at a specific version. That gap is where supplier advisories turn into long email threads and delayed decisions.

The product workflow connects the inventory to the product version and the supplier origin. The free validator and diff make the first two steps usable today; the product-version and supplier view is being built with design partners.

Illustrative relationship

A supplier library ships inside a vendor module, which is linked into a firmware build, which is attached to a product version. The chain is the mental model; the current website does not query your live product data or prove that a specific device is affected.

The workflow, step by step

Validate the SBOM that came with the build and fix identity defects before relying on it.
Compare it with the previous release so the change set is explicit.
Record which product version the build belongs to, and which supplier modules it contains.
When a supplier update arrives, find the product versions that contain the affected module.
Review applicability with the product context, record the decision and keep the evidence with the version.

What works today, and what does not

Live: browser-local SBOM validation with component identity and query-readiness reasons.
Live: two-release comparison with added, removed, updated and unchanged components.
Live: local X.509 decoding for a certificate that ships with a release.
Early Access: supplier-to-product-version traceability, version status and recorded review decisions.
Not available: a supplier portal, automatic impact scoring, or a claim that a device is exploitable.

What we do not claim

The website does not run live vulnerability monitoring or query your product database.
A component match is a lead for review, not proof that a device is affected or exploitable.
Supplier traceability and version status are Early Access, not generally available.
No supplier portal, automatic notification system or compliance certification is offered.

Start with what exists

The free tools need no account and cover the first two questions every programme starts with: is this product in scope, and is this inventory usable?

CRA scope checker SBOM validator Contact us about Early Access