Pith. sign in

REVIEW 2 major objections 100 references

Execution-bound advisory automation for agentic AI: a reproducible AIBOM-driven CSAF-VEX framework

T0 review · 2 major / 0 minor · reviewed 2026-06-26 · grok-4.3

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A protocol-driven framework binds SBOM and AIBOM to deterministic runtime telemetry to compute exploitability and generate signed CSAF-VEX advisories for agentic AI.

desk verdict Framework for signed CSAF-VEX advisories in agentic AI via AIBOM and runtime telemetry, evaluated only on synthetic workloads of 50-5000 components. read the letter →

arxiv 2606.19390 v1 pith:L7ZLZOQE submitted 2026-06-16 cs.SE cs.AI

Petar Radanliev , Omar Santos , Carsten Maple , Kay Atefi This is my paper · ORCID
classification cs.SEcs.AI
keywords SBOMAIBOMCSAF-VEXagenticAIexploitabilityruntimetelemetrysecurityadvisoriesreproducibleframework
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper presents a framework that links software and AI bill-of-materials records to captured execution environments and runtime observations. Exploitability is derived from the combination of declared components, activation conditions, and enforced policies, which then feeds into automatically produced, cryptographically signed CSAF-VEX documents. These documents are checked for consistency through deterministic replay. The approach is demonstrated on roughly 10,000 component entries drawn from synthetic agentic AI workloads ranging from 50 to 5,000 components and standard vulnerability datasets. A sympathetic reader would care because it offers a reproducible path from static and dynamic evidence to machine-readable security advisories without relying solely on manual analysis.

What carries the argument

The AIBOM-driven CSAF-VEX protocol that links declared artefacts and runtime telemetry to signed advisory generation.

What would settle it

Deploy the framework on a live agentic AI system containing a known exploitable component under controlled conditions and check whether the generated VEX advisory correctly flags or clears the component compared with observed exploit success.

Watch

Extended reading notes

Core claim

A protocol-driven framework binds SBOM and AIBOM artefacts to deterministic environment capture and structured runtime telemetry. Exploitability is computed from declared artefacts, observed activation conditions, and enforced execution policies. CSAF VEX advisories are generated from the combined static and runtime evidence, cryptographically signed, and validated through deterministic replay.

Load-bearing premise

Synthetic agentic AI workloads of 50 to 5000 components plus public vulnerability datasets accurately represent real-world execution conditions, and static plus runtime evidence can reliably compute exploitability without significant false positives or negatives.

Editorial extensions

If this is right

  • Advisories can be produced automatically from the combination of static artefacts and observed runtime conditions rather than static analysis alone.
  • Cryptographic signing and deterministic replay make the generated CSAF-VEX documents reproducible across independent verifiers.
  • Evaluation across workloads of 50 to 5000 components shows the framework scales to moderate-sized synthetic agentic systems while incorporating OSV, GitHub Advisory, KEV, and EPSS data.
  • Exploitability calculations incorporate enforced execution policies, allowing policy changes to affect advisory output directly.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the synthetic workloads generalize, the same binding of artefacts to telemetry could support continuous advisory updates in deployed production agentic systems.
  • The approach might reduce reliance on manual triage by surfacing only those vulnerabilities that match observed activation conditions.
  • Integration with existing SBOM tooling could allow the framework to be inserted into existing CI/CD pipelines for AI components without new data formats.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 0 minor

Summary. The manuscript presents a protocol-driven framework that binds SBOM and AIBOM artefacts to deterministic environment capture and structured runtime telemetry. Exploitability is computed from declared artefacts, observed activation conditions, and enforced execution policies. CSAF-VEX advisories are generated from the combined static and runtime evidence, cryptographically signed, and validated through deterministic replay. The evaluation uses approximately 10000 component entries drawn from synthetic Agentic AI workloads of 50 to 5000 components, incorporating OSV, GitHub Advisory, KEV, and EPSS datasets.

Significance. If the framework's claims hold, it would provide a reproducible, evidence-based method for generating execution-bound security advisories tailored to agentic AI systems, potentially improving vulnerability management by linking static declarations with runtime observations and adding cryptographic verifiability. The deterministic replay validation is a notable strength for reproducibility. However, the significance is constrained by the exclusive use of synthetic workloads, which leaves open whether the exploitability signals generalize to real-world conditions.

major comments (2)
  1. [Evaluation description] Evaluation description (abstract and evaluation section): The manuscript states that the evaluation uses approximately 10000 component entries but provides no details on computation methods for exploitability, specific results, error handling, or validation outcomes. This absence makes it impossible to assess whether the static-plus-runtime evidence combination supports the central claim of reliable exploitability computation from artefacts, activation conditions, and policies.
  2. [Evaluation description] Evaluation description (abstract and evaluation section): The framework is tested exclusively on synthetic Agentic AI workloads (50-5000 components) plus public vulnerability datasets, yet no analysis is given of how these map to real-world activation conditions or of the resulting false-positive/negative rates for exploitability. This is load-bearing for the claim that the approach yields reliable advisories beyond the synthetic regime.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive comments regarding the evaluation description. We address each major comment below.

read point-by-point responses

  1. Referee: [Evaluation description] Evaluation description (abstract and evaluation section): The manuscript states that the evaluation uses approximately 10000 component entries but provides no details on computation methods for exploitability, specific results, error handling, or validation outcomes. This absence makes it impossible to assess whether the static-plus-runtime evidence combination supports the central claim of reliable exploitability computation from artefacts, activation conditions, and policies.

    Authors: We agree that the evaluation section lacks these details. In the revised manuscript we will expand the evaluation section to include the exploitability computation methods (including algorithms and formulas), specific quantitative results and metrics from the ~10000 entries, error handling procedures, and validation outcomes from deterministic replay. revision: yes

  2. Referee: [Evaluation description] Evaluation description (abstract and evaluation section): The framework is tested exclusively on synthetic Agentic AI workloads (50-5000 components) plus public vulnerability datasets, yet no analysis is given of how these map to real-world activation conditions or of the resulting false-positive/negative rates for exploitability. This is load-bearing for the claim that the approach yields reliable advisories beyond the synthetic regime.

    Authors: The evaluation deliberately uses synthetic workloads to support deterministic replay and controlled experimentation. We will add a limitations subsection that discusses the design of the synthetic workloads, their intended approximation to real-world agentic AI activation conditions, and a qualitative assessment of possible false-positive/negative implications. Quantitative false-positive/negative rates from real-world deployments are not available in the current study. revision: partial

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity in derivation chain

full rationale

The manuscript describes a framework that binds SBOM/AIBOM artefacts to runtime telemetry for computing exploitability and generating signed CSAF-VEX advisories, with evaluation on synthetic workloads of 50-5000 components plus public vulnerability datasets. No equations, derivations, fitted parameters presented as predictions, or load-bearing self-citations appear in the provided text. The central claims rest on the protocol design and external datasets rather than any self-referential reduction of outputs to inputs by construction, satisfying the default expectation of no significant circularity.

Assumptions & free parameters 0 free parameters · 0 assumptions · 0 invented entities

Abstract provides no information on free parameters, axioms, or invented entities; all arrays are empty due to lack of technical details.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Execution-bound advisory automation for agentic AI: a reproducible AIBOM-driven CSAF-VEX framework." pith.science (2026). https://pith.science/paper/L7ZLZOQE

@misc{pith2026260619390,
  author       = {Pith},
  title        = {Pith review of: Execution-bound advisory automation for agentic AI: a reproducible AIBOM-driven CSAF-VEX framework},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/L7ZLZOQE}},
  note         = {Machine review of arXiv:2606.19390}
}
read the original abstract

A protocol driven framework is presented that binds SBOM and AIBOM artefacts to deterministic environment capture and structured runtime telemetry. Exploitability is computed from declared artefacts, observed activation conditions, and enforced execution policies. CSAF VEX advisories are generated from combined static and runtime evidence, cryptographically signed, and validated through deterministic replay. Evaluation uses approximately 10000 component entries across synthetic Agentic AI workloads 50 to 5000 components, incorporating OSV, GitHub Advisory, KEV, and EPSS datasets.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

100 extracted references · 18 canonical work pages

  1. [1]

    # Pseudocode for Secure and Reproducible CSAF-VEX Assertion Generation 2

  2. [2]

    function initiate_advisory_pipeline(container_image, input_data, execution_policy):

  3. [3]

    # STAGE 1: Environment Initialisation and MCP Context Capture

  4. [4]

    mcp_metadata = MCP.capture_pre_execution_state(

  5. [5]

    Petar Radanliev Parks Road, Oxford OX1 3PJ United Kingdom Email: petar.radanliev@cs.ox.ac.uk BA Hons., MSc., Ph.D

    ) Dr. Petar Radanliev Parks Road, Oxford OX1 3PJ United Kingdom Email: petar.radanliev@cs.ox.ac.uk BA Hons., MSc., Ph.D. Post-Doctorate 33

  6. [6]

    mcp_hash = Crypto.sign_and_seal(mcp_metadata) 11

  7. [7]

    # STAGE 2: Runtime Telemetry via Agent2Agent Protocol

  8. [8]

    runtime_agent = A2A.spawn_agent(

Show all 100 references
  1. [9]

    telemetry_stream = A2A.collect_runtime_telemetry(runtime_agent) 19

  2. [10]

    # STAGE 3: Exploitability Inference

  3. [11]

    sbom_data = SBOM.extract(mcp_metadata)

  4. [12]

    matched_cves = VulnerabilityScanner.match_cves(sbom_data)

  5. [13]

    exploitability_report = InferenceEngine.assess_exploitability(

  6. [14]

    # STAGE 4: CSAF-VEX Assertion Generation

  7. [15]

    vex_document = CSAF.build_vex_assertions(

  8. [16]

    exploitability_report,

  9. [17]

    runtime_agent.identity

  10. [18]

    signed_vex = Crypto.sign_vex(vex_document) 37

  11. [19]

    # STAGE 5: Advisory Validation via AGNTCY Orchestration

  12. [20]

    if AGNTCY.validate_agent(runtime_agent.identity) and AGNTCY.validate_vex(signed_vex):

  13. [21]

    AGNTCY.register_advisory(signed_vex)

  14. [22]

    VEX validation failed or agent unauthorised

    raise SecurityException("VEX validation failed or agent unauthorised") 43

  15. [23]

    # STAGE 6: Reproducibility Testing and Audit Verification

  16. [24]

    audit_environment = clone_environment(mcp_metadata)

  17. [25]

    audit_output = replay_advisory_pipeline(...)

  18. [26]

    audit_environment.image,

  19. [27]

    audit_environment.input_data,

  20. [28]

    audit_environment.policy

  21. [29]

    if Hash.compare(signed_vex, audit_output.signed_vex):

  22. [30]

    TransparencyLayer.publish(signed_vex, metadata=mcp_metadata)

  23. [31]

    Audit hash mismatch: advisory not reproducible

    raise ReproducibilityException("Audit hash mismatch: advisory not reproducible") 55. This pseudocode operationalises the six-stage framework as follows:

  24. [32]

    Initialisation (MCP Capture): Captures system fingerprint, dependency graphs, security policy context, and cryptographically signs the metadata envelope

  25. [33]

    Runtime Coordination (A2A): Deploys secure agents for process-level observability and policy-scoped telemetry logging

  26. [34]

    Exploitability Inference: Matches observed components to known CVEs and evaluates their exploitability using runtime conditions and policy enforcement logs

  27. [35]

    CSAF-VEX Generation: Constructs formal vulnerability statements based on CSAF 2.0/VEX schema, integrating runtime evidence and MCP lineage. Dr. Petar Radanliev Parks Road, Oxford OX1 3PJ United Kingdom Email: petar.radanliev@cs.ox.ac.uk BA Hons., MSc., Ph.D. Post-Doctorate 34

  28. [36]

    Advisory Validation (AGNTCY): Validates advisory schema and signs artefacts through a decentralised trust authority, ensuring audit traceability

  29. [37]

    what is deployed

    Reproducibility Verification: Re-executes the containerised job under identical conditions, ensuring the advisory output is deterministically reproducible. Confirms this via hash comparison before publication in a federated graph- based transparency layer. The empirical evalua...

  30. [38]

    Lemay, Antoine., and Katiyar, Neeraj, ‘Supply Chain Risk Analysis Via SBOM Data Enrichment’, SysCon 2025 - 19th Annual IEEE International Systems Conference, Proceedings, 2025, doi: 10.1109/SYSCON64521.2025.11014830

    2025 doi

  31. [39]

    13–16, 2025, doi: 10.1109/ICSE-COMPANION66252.2025.00013

    Jia, Changguo., Li, Nianyu., Yang, Kai., and Zhou, Minghui, ‘SIT: An Accurate, Compliant SBOM Generator with Incremental Construction’, Proceedings - International Conference on Software Engineering, pp. 13–16, 2025, doi: 10.1109/ICSE-COMPANION66252.2025.00013. Dr. Petar Radan...

    2025 doi

  32. [40]

    ISO, 2025, URL: https://www.iso.org/standard/89986.html

    ISO, ISO/IEC 20153:2025 - Information technology — OASIS Common Security Advisory Framework (CSAF) v2.0 Specification. ISO, 2025, URL: https://www.iso.org/standard/89986.html

    2025

  33. [41]

    [Online]

    Springett, Steve, ‘Vulnerability and Exploitability Transparency - VDR & VEX | OWASP Foundation’, OWASP, Feb-2023. [Online]. Available: https://owasp.org/blog/2023/02/07/vdr-vex-comparison. [Accessed: 25-Apr- 2023], URL: https://owasp.org/blog/2023/02/07/vdr-vex-comparison

    2023

  34. [42]

    [Online]

    OWASP, ‘OWASP AIBOM | OWASP Foundation’, 2025. [Online]. Available: https://owasp.org/www-project-aibom/. [Accessed: 12-Jul-2025], URL: https://owasp.org/www-project-aibom/

    2025

  35. [43]

    Thomas Schmidt, ‘Vulnerability management with CSAF – why SBOM is not enough’, Frankfurt, 2022, URL: https://owasp.org/www-chapter- frankfurt/assets/slides/58_OWASP_Frankfurt_Stammtisch_1.pdf

    2022

  36. [44]

    [Online]

    OASIS, ‘Using CSAF to Respond to Supply Chain Vulnerabilities at Large Scale’, OASIS Open, 2022. [Online]. Available: https://us06web.zoom.us/webinar/register/WN_KqD-a1t5SpuMI7w9cI7ZDg. [Accessed: 03-Jan-2023], URL: https://us06web.zoom.us/webinar/register/WN_KqD-a1t5SpuMI7w9cI7ZDg

    2022

  37. [45]

    Schmidt, Leon., Hammer, Daniel., Biß, Klaus., and Schmidt, Thomas, ‘Media Faculty in cooperation with the Development of an API to request security advisories for CSAF 2.0 by Enterprise and IT Security Supervision’, 2022

    2022

  38. [46]

    TREvolution, ‘TREvolution - DARE UK’, 2025, URL: https://dareuk.org.uk/how- we-work/ongoing-activities/trevolution/

    2025

  39. [47]

    Li, Qiaomu., and Xie, Ying, ‘From Glue-Code to Protocols: A Critical Analysis of A2A and MCP Integration for Scalable Agent Systems’, May 2025, URL: https://arxiv.org/pdf/2505.03864

    2025

  40. [48]

    Priv., vol

    Okhravi, Hamed., Burow, Nathan., and Schneider, Fred B., ‘Software Bill of Materials as a Proactive Defense’, IEEE Secur. Priv., vol. 23, no. 2, pp. 101– 106, 2025, doi: 10.1109/MSEC.2025.3528535

    2025 doi

  41. [49]

    Azizi, Sara., Pakshad, Puya., Shameli-Sendi, Alireza., and Faraji Daneshgar, Fateme, ‘Vulnerability scoring metric of CVSS needs to be adjusted per each product: our analysis on Linux and Apache’, Information Security Journal, May 2025, doi: 10.1080/19393555.2025.2498466;JOURN...

    2025 doi

  42. [50]

    141–160, 2024, doi: 10.23919/CYCON62501.2024.10685598

    Beninger, Max., Charland, Philippe., Ding, Steven H.H., and Fung, Benjamin C.M., ‘ERS0: Enhancing Military Cybersecurity with AI-Driven SBOM for Firmware Vulnerability Detection and Asset Management’, International Conference on Cyber Conflict, CYCON, pp. 141–160, 2024, doi: 1...

    2024 doi

  43. [51]

    Liqian Lim, ‘The Essential Guide to AI Bills of Materials (AIBOMs)’, 2025, URL: https://snyk.io/articles/ai-security/ai-bill-of-materials-aibom/

    2025

  44. [52]

    [Online]

    Rao Surapaneni., Miku Jha., Michael Vakoc., and Todd Segal, ‘Announcing the Agent2Agent Protocol (A2A)’, Google Developers Blog, 2025. [Online]. Available: https://developers.googleblog.com/en/a2a-a-new-era-of-agent- interoperability/. [Accessed: 05-Jul-2025], URL: https://dev...

    2025

  45. [53]

    [Online]

    AGNTCY, ‘AGNTCY.org’, An open source collective for inter-agent collaboration., 2025. [Online]. Available: https://agntcy.org/. [Accessed: 05-Jul- 2025], URL: https://agntcy.org/

    2025

  46. [54]

    [Online]

    VEX, ‘Vulnerability Exploitability eXchange (VEX) – Use Cases’, 2022. [Online]. Available: https://www.cisa.gov/sbom. [Accessed: 03-Jan-2023], URL: https://www.cisa.gov/sbom

    2022

  47. [55]

    Department of Homeland Security, Cybersecurity and Infrastructure Security Agency, 2023, URL: http://www.cisa.gov/tlp/

    CISA, ‘Minimum Requirements for Vulnerability Exploitability eXchange (VEX)’, U.S. Department of Homeland Security, Cybersecurity and Infrastructure Security Agency, 2023, URL: http://www.cisa.gov/tlp/

    2023

  48. [56]

    [Online]

    Kunorubwe, Peter., Martin, Alex, ‘Managing the risks and realising the opportunities of using third party Software Asset Management (SAM) providers’, Deloitte, 06-Jul-2018. [Online]. Available: https://www.deloitte.com/uk/en/services/audit-assurance/research/sam-blogs- and-bul...

    2018

  49. [57]

    [Online]

    Wiesner, Jens, ‘CSAF, Not SBOM, Is The Solution’, S4x22 - BSI, 2022. [Online]. Available: https://www.youtube.com/watch?v=fKlW9vOs7X4&t=504s. [Accessed: 03-Jan-2023], URL: https://www.youtube.com/watch?v=fKlW9vOs7X4&t=504s

    2022

  50. [58]

    [Online]

    NIST, ‘NVD - CVSS v3 Calculator’, CVSS Version 3.1, 2022. [Online]. Available: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator. [Accessed: 03- Jan-2023], URL: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator

    2022

  51. [59]

    [Online]

    Manion, Art, ‘SSVC: Stakeholder-Specific Vulnerability Categorization’, Carnegie Mellon University, 2020. [Online]. Available: https://bit.ly/3ambIP4. [Accessed: 02-Jan-2023], URL: https://bit.ly/3ambIP4

    2020

  52. [60]

    [Online]

    NIST, ‘Product Integration using NVD CVSS Calculators’, 2022. [Online]. Available: https://nvd.nist.gov/Vulnerability-Metrics/Calculator-Product- Integration. [Accessed: 09-Jan-2026], URL: https://nvd.nist.gov/Vulnerability- Metrics/Calculator-Product-Integration

    2022

  53. [61]

    Williams, Laurie., Benedetti, Giacomo., Hamer, Sivana., Paramitha, Ranindya., Rahman, Imranur., Tamanna, Mahzabin., Tystahl, Greg., … Enck, William, ‘Research Directions in Software Supply Chain Security’, ACM Transactions on Software Engineering and Methodology, vol. 34, no. ...

    2025 doi

  54. [62]

    Takahashi, Takeshi., and Kadobayashi, Youki, ‘Reference Ontology for Cybersecurity Operational Information’, Comput. J., vol. 58, no. 10, pp. 2297– 2312, Oct. 2015, doi: 10.1093/COMJNL/BXU101, URL: https://dx.doi.org/10.1093/comjnl/bxu101

    2015 doi

  55. [63]

    2022, doi: 10.2172/1901825

    Eggers, Shannon Leigh., Christensen, Drew., Simon, Tori Brooke., Morgan, Baleigh Rae., and Bauer, Ethan S, ‘Towards Software Bill of Materials in the Nuclear Industry’, Sep. 2022, doi: 10.2172/1901825

    2022 doi

  56. [64]

    2022, URL: https://uptane.org/papers/scudo-whitepaper.pdf

    Moore, Marina., Sirish, Aditya., Yelgundhalli, A., Kuppusamy, Trishank Karthik., Torres-Arias, Santiago., Delong, Lois Anne., and Cappos, Justin, ‘Scudo: A Proposal for Resolving Software Supply Chain Insecurities in Vehicles The second in a series of whitepapers on emerging a...

    2022

  57. [65]

    [Online]

    Jackson, Wayne, ‘Code, Cars, and Congress: A Time for Cyber Supply Chain Management (1 of 3)’, Sonatype, 2014. [Online]. Available: https://blog.sonatype.com/2014/12/cyber-supply-chain-management-part1/. [Accessed: 03-Jan-2023], URL: https://blog.sonatype.com/2014/12/cyber- su...

    2014

  58. [66]

    [Online]

    NTIA, ‘SBOM at a Glance’, NTIA Multistakeholder Process on Software Component Transparency | ntia.gov/sbom, 2021. [Online]. Available: https://tiny.cc/SPDX. [Accessed: 03-Jan-2023], URL: https://tiny.cc/SPDX

    2021

  59. [67]

    [Online]

    Royce, Edward R., ‘H.R.5793 - 113th Congress (2013-2014): Cyber Supply Chain Management and Transparency Act of 2014’, Congress.Gov, 2014. [Online]. Available: http://www.congress.gov/. [Accessed: 03-Jan-2023], URL: http://www.congress.gov/

    2013

  60. [68]

    [Online]

    Howard, Matt, ‘Cybersecurity Improvement Act of 2017: The Ghost of Congress Past - DevOps.com’, devops.com, 2017. [Online]. Available: https://devops.com/cybersecurity-improvement-act-2017-ghost-congress-past/. [Accessed: 03-Jan-2023], URL: https://devops.com/cybersecurity- im...

    2017

  61. [69]

    [Online]

    Biden, Joseph, ‘Executive Order on Improving the Nation’s Cybersecurity | The White House’, The White House, 12-May-2021. [Online]. Available: https://www.whitehouse.gov/briefing-room/presidential- actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/. [Ac...

    2021

  62. [70]

    56–60, doi: 10.1145/3713081.3731738, URL: https://dl.acm.org/doi/pdf/10.1145/3713081.3731738

    Qiu, Tong., Zhu, Jiaxin., Chen, Wei., and Wei, Jun, ‘LiPSBOMaker: A Prototype of Multi-Stage Linux Distribution Package SBOM Generator’, 2025, pp. 56–60, doi: 10.1145/3713081.3731738, URL: https://dl.acm.org/doi/pdf/10.1145/3713081.3731738. Dr. Petar Radanliev Parks Road, Oxfo...

    2025 doi

  63. [71]

    [Online]

    CISA, ‘Software Bill of Materials’, Cybersecurity & Infrastructure Security Agency, 2018. [Online]. Available: https://www.cisa.gov/sbom. [Accessed: 24- Dec-2022], URL: https://www.cisa.gov/sbom

    2018

  64. [72]

    Washington, D.C: The National Telecommunications and Information Administration (NTIA), 2021, URL: https://ntia.gov/page/software- bill-materials

    NTIA, National Telecommunications and Information Administration, Software Bill of Materials (SBOM) | National Telecommunications and Information Administration. Washington, D.C: The National Telecommunications and Information Administration (NTIA), 2021, URL: https://ntia.gov...

    2021

  65. [73]

    Capability: A Comparative Analysis of the SBOM Generation Tools for Rust Projects’, Proceedings of the ACM Symposium on Applied Computing, pp

    Rabbi, Md Fazle., Champa, Arifa Islam., and Zibran, Minhaz Fahim, ‘Claim vs. Capability: A Comparative Analysis of the SBOM Generation Tools for Rust Projects’, Proceedings of the ACM Symposium on Applied Computing, pp. 1712–1720, May 2025, doi: 10.1145/3672608.3707940, URL: /...

    2025 doi

  66. [74]

    576–580, doi: 10.1109/MSR66628.2025.00090

    Kishimoto, Rio., Kanda, Tetsuya., Manabe, Yuki., Inoue, Katsuro., Qiu, Shi., and Higo, Yoshiki, ‘A Dataset of Software Bill of Materials for Evaluating SBOM Consumption Tools’, in 2025 IEEE/ACM 22nd International Conference on Mining Software Repositories (MSR), 2025, pp. 576–...

    2025 doi

  67. [75]

    [Online]

    SPDX, ‘Software Package Data Exchange (SPDX)’, International Open Standard (ISO/IEC 5962:2021) , 2023. [Online]. Available: https://spdx.dev/. [Accessed: 19-Apr-2023], URL: https://spdx.dev/

    2021

  68. [76]

    [Online]

    CycloneDX, ‘OWASP CycloneDX Software Bill of Materials (SBOM) Standard’, Full-stack Bill of Materials (BOM) standard, 2023. [Online]. Available: https://cyclonedx.org/. [Accessed: 19-Apr-2023], URL: https://cyclonedx.org/

    2023

  69. [77]

    [Online]

    SWID, ‘Software Identification (SWID) Tagging | CSRC | NIST’, National Institute of Standards and Technology. [Online]. Available: https://csrc.nist.gov/projects/Software-Identification-SWID. [Accessed: 19-Apr- 2023], URL: https://csrc.nist.gov/projects/Software-Identification-SWID

    2023

  70. [78]

    [Online]

    O’Driscoll, Aimee, ‘25+ Cyber Security Vulnerability Statistics and Facts of 2023’, Comparitech, 2022. [Online]. Available: https://www.comparitech.com/blog/information-security/cybersecurity- vulnerability-statistics/. [Accessed: 03-Jan-2023], URL: https://www.comparitech.com...

    2023

  71. [79]

    NTIA, the U.S. National Telecommunications and Information Administration, ‘Vulnerability-Exploitability eXchange (VEX)’, 2021, URL: https://ntia.gov/files/ntia/publications/vex_one-page_summary.pdf

    2021

  72. [80]

    [Online]

    OASIS, ‘OASIS Common Security Advisory Framework (CSAF) TC | OASIS’, OASIS OPEN, 2022. [Online]. Available: https://www.oasis- open.org/committees/tc_home.php?wg_abbrev=csaf. [Accessed: 03-Jan- 2023], URL: https://www.oasis- open.org/committees/tc_home.php?wg_abbrev=csaf. Dr. ...

    2022

  73. [81]

    [Online]

    Meyers, John Speed, ‘Are SBOMs Any Good? Preliminary Measurement of the Quality of Open Source Project SBOMs’, Chainguard, 2022. [Online]. Available: https://www.chainguard.dev/unchained/are-sboms-any-good- preliminary-measurement-of-the-quality-of-open-source-project-sboms. [...

    2022

  74. [82]

    Carmody, Seth., Coravos, Andrea., Fahs, Ginny., Hatch, Audra., Medina, Janine., Woods, Beau., and Corman, Joshua, ‘Building resilient medical technology supply chains with a software bill of materials’, npj Digital Medicine 2021 4:1, vol. 4, no. 1, pp. 1–6, Feb. 2021, doi: 10....

    2021 doi

  75. [83]

    [Online]

    Alrich, Tom, ‘Rethinking VEX’, Blogger, Dec-2022. [Online]. Available: https://tomalrichblog.blogspot.com/2022/12/rethinking-vex.html. [Accessed: 07- May-2026], URL: https://tomalrichblog.blogspot.com/2022/12/rethinking- vex.html

    2022

  76. [84]

    Minimum elements

    Alrich, Tom, ‘“Minimum elements”, Bigfoot, and other myths’, Blog, 2022. [Online]. Available: https://tomalrichblog.blogspot.com/2022/. [Accessed: 03- Jan-2023], URL: https://tomalrichblog.blogspot.com/2022/

    2022

  77. [85]

    [Online]

    Dependency-Track, ‘Software Bill of Materials (SBOM) Analysis | OWASP’, Dependency-Track, 2022. [Online]. Available: https://dependencytrack.org/. [Accessed: 03-Jan-2023], URL: https://dependencytrack.org/

    2022

  78. [86]

    NIST, The MITRE Corporation, Internet Engineering Task Force (IETF), 2023, URL: https://datatracker.ietf.org/doc/rfc9393/

    Birkholz, Henk., Fitzgerald-McKay, Jessica., Schmidt, Charles., Waltermire, David, Concise Software Identification Tags - RFC 9393. NIST, The MITRE Corporation, Internet Engineering Task Force (IETF), 2023, URL: https://datatracker.ietf.org/doc/rfc9393/

    2023

  79. [87]

    NTIA, Multistakeholder Process on Software Component Transparency - Standards and Formats Working Group, ‘Survey of Existing SBOM Formats and Standards-Version 2021 Survey of Existing SBOM Formats and Standards Credit: Photo by Patrick Tomasso on Unsplash NTIA Multistakeholder...

    2021

  80. [88]

    [Online]

    Alrich, Tom., and Brudo, Barak, ‘Secrets Of The Vulnerability Exploitability eXchange (VEX) Webinar’, Scribe Securely, 2022. [Online]. Available: https://www.youtube.com/watch?v=dyvuNqX_wJ8. [Accessed: 03-Jan-2023], URL: https://www.youtube.com/watch?v=dyvuNqX_wJ8

    2022

  81. [89]

    Wilkinson, Mark D., Dumontier, Michel., Sansone, Susanna Assunta., Bonino da Silva Santos, Luiz Olavo., Prieto, Mario., Batista, Dominique., McQuilton, Peter., … Schultes, Erik, ‘Evaluating FAIR maturity through a scalable, automated, community-governed framework’, Scientific ...

    2019 doi

  82. [90]

    [Online]

    Groll, Elias.,., and Hewitt-Jones, John, ‘Software bills of materials face long road to adoption’, CyberScoop, 2022. [Online]. Available: https://www.cyberscoop.com/dhs-sbom-adoption/. [Accessed: 03-Jan-2023], URL: https://www.cyberscoop.com/dhs-sbom-adoption/

    2022

  83. [91]

    [Online]

    Alrich, Tom, ‘Real-time VEX’, Blog, 07-Sep-2022. [Online]. Available: https://tomalrichblog.blogspot.com/2022/09/real-time-vex.html. [Accessed: 03- Jan-2023], URL: https://tomalrichblog.blogspot.com/2022/09/real-time- vex.html

    2022

  84. [92]

    [Online]

    CISA, ‘CISA Stakeholder-Specific Vulnerability Categorization Guide’, Cybersecurity and Infrastructure Security Agency, Nov-2022. [Online]. Available: https://www.cisa.gov/sites/default/files/publications/cisa-ssvc- guide%20508c.pdf. [Accessed: 03-Jan-2023], URL: https://www.c...

    2022

  85. [93]

    Wilkinson, Mark D., Dumontier, Michel., Aalbersberg, IJsbrand Jan., Appleton, Gabrielle., Axton, Myles., Baak, Arie., Blomberg, Niklas., … Mons, Barend, ‘The FAIR Guiding Principles for scientific data management and stewardship’, Scientific Data 2016 3:1, vol. 3, no. 1, pp. 1...

    2016 doi

  86. [94]

    [Online]

    OSS, ‘Sonatype OSS Index’, 2022. [Online]. Available: https://ossindex.sonatype.org/. [Accessed: 03-Jan-2023], URL: https://ossindex.sonatype.org/

    2022

  87. [95]

    37–45, May 2025, doi: 10.1109/SVM66695.2025.00010

    Garcia, Derek., Mirakorhli, Mehdi Tarrit., Dillon, Schuyler., Laporte, Kevin., Morrison, Matthew., Lu, Henry., Koscinski, Viktoria., … Chen, Roger, ‘A Landscape Study of Open-Source Tools for Software Bill of Materials (SBOM) and Supply Chain Security’, 2025 IEEE/ACM 3rd Inter...

    2025 doi

  88. [96]

    Grype, ‘anchore/grype: A vulnerability scanner for container images and filesystems’, 2025, URL: https://github.com/anchore/grype

    2025

  89. [97]

    Anchore GitHub Repository.’, 2024, URL: https://github.com/anchore/syft

    Syft, ‘Syft: CLI Tool and Library for Generating SBOMs”. Anchore GitHub Repository.’, 2024, URL: https://github.com/anchore/syft

    2024

  90. [98]

    In: Ludäscher, B., Plale, B

    Huynh, Trung Dong., and Moreau, Luc, ‘Provstore: A public provenance repository’, in ProvStore: A Public Provenance Repository. In: Ludäscher, B., Plale, B. (eds) Provenance and Annotation of Data and Processes. IPAW

  91. [99]

    8628, Cham: Springer Verlag, 2015, pp

    Lecture Notes in Computer Science - Springer, Cham, vol. 8628, Cham: Springer Verlag, 2015, pp. 275–277, doi: 10.1007/978-3-319-16462-5_32, URL: https://dl.acm.org/doi/10.1007/978-3-319-16462-5_32

    2015 doi

  92. [100]

    Petar Radanliev Parks Road, Oxford OX1 3PJ United Kingdom Email: petar.radanliev@cs.ox.ac.uk BA Hons., MSc., Ph.D

    Chirigati, Fernando., Rampin, Rémi., Shasha, Dennis., and Freire, Juliana, ‘ReproZip: Computational reproducibility with ease’, Proceedings of the ACM Dr. Petar Radanliev Parks Road, Oxford OX1 3PJ United Kingdom Email: petar.radanliev@cs.ox.ac.uk BA Hons., MSc., Ph.D. Post-Do...

    2016 doi

Pith tools

Reviewed June 26, 2026 · model on record in the stance chip above.