Glossary

SBOM — Software Bill of Materials. A machine-readable inventory of the components in a piece of software.

CycloneDX / SPDX — the two open SBOM formats TraceGuard ingests.

Component — a single package, library, or part listed in a BOM.

Vulnerability — a known weakness (e.g. a CVE) that may affect a component.

Finding — a vulnerability in the context of a specific component in a specific project. Findings are what you triage.

VEX — Vulnerability Exploitability eXchange. A statement about whether a vulnerability actually affects you: affected, not affected, fixed, or under investigation — with a justification.

KEV — CISA's Known Exploited Vulnerabilities catalog. A vulnerability in KEV is being exploited in the wild, so it's prioritized.

EPSS — Exploit Prediction Scoring System. A probability (0–1) that a vulnerability will be exploited in the near term.

Applicability rule — a reusable rule that decides which findings apply to your context, so you can govern triage at scale instead of one finding at a time.

Evidence bundle — an exportable package of proof (findings, decisions, VEX, snapshots) suitable for an auditor.

Assurance — the append-only record that ties findings and decisions together into continuous, audit-ready proof.