Knowledge

SBOM, VEX and CSAF: how it all fits together

SBOMs show what's inside. VEX tells you whether it affects you. CSAF carries both. An overview.

Sofia Marino

3 July 2026· 6 min read

SBOM – the ingredient list

A software bill of materials lists all components of a product. Formats: CycloneDX and SPDX.

Vulnerability Exploitability eXchange states whether a known vulnerability in a component actually affects your product.

CSAF 2.0 has its own VEX profile. It lets you communicate in a machine-readable way: affected, not affected, fixed or under investigation.

In Secvisory, SBOMs are attached to the product catalog – and advisories reference the same products.

Actively exploited vulnerabilities must now be reported within 24 hours. We explain the deadlines and how to meet them reliably.

Verify your domain, create keys, publish your first advisory: how to become a trusted provider – in one afternoon.

Get suggestions for descriptions, remediations and product mappings – suggestions only, you stay in control.