17 analyses · 1 verdict

What we analyze, engine by engine

A single upload runs 17 independent analyses: inventory, quality, conformance, multi-engine vulnerabilities and exploit prioritization. Here is exactly what each one does.

Run a scan Open the SBOM viewer

Inventory normalization

native + Syft

Parses CycloneDX, SPDX and Syft into one canonical component model so every later check sees the same inventory.

SBOM quality score

sbomqs

Scores versions, licenses, suppliers, PURLs, CPEs and hashes - a clean scan on a poor SBOM is flagged as low confidence.

NTIA minimum elements

ntia-conformance-checker

Checks the NTIA minimum-elements baseline every compliant SBOM must meet.

SPDX validation

pyspdxtools (SPDX project)

Validates SPDX documents against the SPDX specification with the SPDX project's own tooling, so structural problems surface immediately.

CISA 2026 minimum elements

native

Checks the SBOM against the 2026 CISA Minimum Elements (final, successor to NTIA 2021): component hash and a machine-readable license are now part of the baseline, plus producer name, identifiers and dependency relationships.

BSI TR-03183 fields

native

Checks the mandatory per-component data fields of the German BSI TR-03183-2 guideline (v2.1.0), the reference many German buyers and CRA programs align on.

Vulnerability scan (Grype)

Grype

Matches components to known CVEs by package and version across many ecosystems.

Vulnerability scan (OSV-Scanner)

OSV-Scanner

Cross-checks the same inventory against the OSV database for a second, independent verdict.

Binary / embedded CVEs

cve-bin-tool

Finds CVEs in compiled and C/C++ components that package-name matching alone misses.

Multi-ecosystem scan

Trivy

Adds broad cross-ecosystem CVE coverage as a third scanning engine.

Live advisory intelligence

OSV.dev

Queries the OSV.dev API live by PURL so fresh advisories show up without waiting for a DB refresh.

Known-exploited priority

CISA KEV

Flags vulnerabilities listed in the CISA Known Exploited Vulnerabilities catalog - fix these first.

EU known-exploited priority

ENISA EUVD

Cross-checks every finding against the exploited-vulnerabilities catalog of the European Union Vulnerability Database, run by ENISA.

Exploit probability

EPSS

Adds the EPSS 30-day exploit-probability score so triage follows real-world likelihood, not just severity.

End-of-life components

endoflife.date

Matches components against the endoflife.date catalog and flags any release train that is past, or within six months of, its end-of-life date.

Dependency security posture

native

Rolls findings up per dependency - version gaps, missing identifiers and CVEs - into one risk level with a recommended action.

Consensus merge + verdict

native merger

Deduplicates findings across all engines by (CVE, component), keeps per-engine attribution, and emits one consensus verdict.

Built for embedded

Generate the SBOM, then scan it

Zephyr and Yocto already emit SPDX SBOMs at build time. Produce them in your build, then drop them here for all 17 analyses.

Zephyr RTOS

west generates SPDX 2.3 from your build. Enable CONFIG_BUILD_OUTPUT_META:

west spdx --init -d build
# set CONFIG_BUILD_OUTPUT_META=y
west build -d build
west spdx -d build
# → build/spdx/app.spdx, zephyr.spdx,
#   build.spdx, modules-deps.spdx

Yocto / OpenEmbedded

The create-spdx class is inherited by default (INHERIT_DISTRO). Building an image emits an SPDX JSON:

bitbake core-image-minimal
# → tmp/deploy/images/MACHINE/
#   IMAGE-MACHINE.spdx.json
# meta-timesys / sbom-cve-check add
# CVE feeds to the Yocto flow

CRA readiness

Facts, not promises

The Cyber Resilience Act references the SBOM in Annex I, Part II, point (1), and Article 14 requires reporting of actively exploited vulnerabilities: early warning within 24h, notification within 72h, final report within 14 days of a fix (applies from 11 September 2026). This tool documents your gaps and prioritizes CVEs - it makes no certification claims.

Read the full CRA and SBOM evidence guide

Verified sources: docs.zephyrproject.org · docs.yoctoproject.org · digital-strategy.ec.europa.eu/en/policies/cra-reporting

Keep your scans and results

Create a free account to save your scan history and results across devices, re-open and rescan any SBOM, and use our API to scan from CI and pull results programmatically.