A Software Bill of Materials (SBOM) lists every component an application ships with — not just the libraries a developer typed into a manifest (direct dependencies), but everything those libraries themselves pull in (transitive dependencies), often four or five levels deep.
Most real-world supply-chain vulnerabilities are found deep in this tree: a tiny, unglamorous utility package with almost no visibility gets compromised or found vulnerable, and because dozens of popular libraries quietly depend on it, the blast radius reaches applications whose developers never even heard its name.
- Scan SBOM — walks every node in the tree and cross-references it against a known-vulnerability list, surfacing CVE IDs and severity scores.
- Simulate compromise — pick any package and "poison" it; the simulation traces every ancestor path back to the root application to show exactly which deployed products inherit the compromise.
- Depth matters — the deeper a vulnerable package sits, the more invisible it is to a manual review, and the more projects transitively depend on it without anyone noticing.