Introduction

TraceGuard is a software supply-chain security platform. You bring in a Software Bill of Materials (SBOM) for each of your projects; TraceGuard parses it, scans the components for known vulnerabilities, enriches them with real-world risk signals, and turns the results into findings you can triage, justify with VEX, and hand to an auditor as evidence.

The pipeline

Everything in TraceGuard follows one path:

1. Ingest — an SBOM arrives (CI upload, GitHub sync, or manual upload).
2. Parse — CycloneDX or SPDX is normalized into components and dependencies.
3. Scan — components are matched against vulnerability data, then enriched with KEV (known-exploited) and EPSS (exploit-probability) signals.
4. Findings — each match becomes a finding you can prioritize, assign a VEX status, exclude, or govern with applicability rules.

The output is a continuously up-to-date, audit-ready picture of your supply-chain risk — per project and across your whole organization.

Who it's for

• Security & platform teams standardizing SBOM management across many repos.
• Compliance owners who need evidence and assurance on demand (CRA, ISO 27001).
• Public-sector and regulated organizations with strict isolation requirements.

Next steps

• Why SBOMs? — new to supply-chain security? Start here.
• Core concepts — the nouns: organizations, projects, BOMs, findings, VEX, assurance.
• Quickstart — get your first SBOM scanned in ~5 minutes.
• Glossary — SBOM, VEX, KEV, EPSS, and friends.