Login Request a demo
Your stack

Monitor your own SBOM

Tell us what you run. We turn it into a standard software bill of materials that you own, then show every new CVE, exploit and breach against it.

Build my list
The basics
What is an SBOM?

A software bill of materials is an ingredient list for your technology. It names each product you run, who makes it and which version you have.

When a new vulnerability is announced, the list answers the only question that matters: do we have this? Without one, that answer takes a round of emails and a spreadsheet hunt. With one, it takes seconds.

You don't need developers, scanners or agents to make one. A list of product names is enough to start.

Your SBOM, simplifiedVersion
FO
FortiOS
Fortinet
7.4.3
ES
Exchange Server
Microsoft
2019 CU14
SC
ScreenConnect
ConnectWise
23.9.8
CO
Confluence
Atlassian
8.5.1
Keep it focused
Don’t boil the ocean

A full SBOM can list thousands of components. You don’t need that to stay safe. Attackers go after the systems they can reach, so start there.

✓Start with

  • Internet-facing gear. Firewalls, VPNs, load balancers and gateways.
  • Remote access tools. Remote desktop, remote support and RMM software.
  • Email and collaboration you host. Mail servers, wikis, intranets.
  • Identity. SSO, directory and MFA services.
  • File transfer and backup. Anything that moves or stores bulk data.
  • The few business apps you can’t run without.

–Leave out for now

  • Every library inside every app. That’s your software vendors’ SBOM, not yours.
  • Employee laptops and browsers. Patch management already covers them.
  • SaaS you don’t host. That’s vendor risk, and we track their breaches anyway.
  • Developer tooling, unless it faces the internet.
Most organisations start with 15 to 40 titles. That covers the systems attackers reach first.
How it works
01
List your titles

Type the products you run. Versions are optional but make alerts sharper. Mark what faces the internet.

Takes about 10 minutes
02
We generate your SBOM

We build a CycloneDX file from your list. It’s yours to download, edit, hand to auditors or load into any other tool.

environment.cdx.json
03
We track and notify

Every new CVE, exploitation report and breach is matched against your SBOM. You hear about what touches your stack, and nothing else.

Email · digest · webhook
Your file
What the SBOM looks like
// CycloneDX 1.6 · open standard (OWASP, ECMA-424) { "bomFormat": "CycloneDX", "specVersion": "1.6", "components": [ { "type": "operating-system", "supplier": { "name": "Fortinet" }, "name": "FortiOS", "version": "7.4.3", "cpe": "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*" } ] }
What we watch
You get alerted when
A new critical or high CVE
lands for a product in your SBOM
A CVE is added to CISA KEV
meaning attackers are actively using it
A breach or advisory names your product
so you see real incidents, not just scores
Your weekly digest
filtered to your stack only
Questions
Common questions
Do I need exact versions?

No. A product name is enough to start. Adding a version lets us tell you whether a CVE affects the build you actually run, which cuts the noise a lot.

Is this the same as the SBOM my developers produce?

Not quite. A developer SBOM lists the code libraries inside one application. This is an environment SBOM: the products your organisation runs. Both are CycloneDX, and this one is the right size for monitoring risk.

Who can see my list?

Your list is kept in your own browser until you choose to start monitoring. We never publish it, share it or use it to market to you. You can download or clear it at any time.

What if a product isn’t in our index?

Add it anyway as a custom title. It stays in your SBOM, and we start matching the moment a CVE or breach names it.

I already have an SBOM. Can I use it?

Yes. Upload a CycloneDX or SPDX JSON file and we pick up every product we track. Anything else stays in the file as a custom title.

Get started
Build your list. See only what touches your stack.
Free to start. Your SBOM is yours to keep.