Glossary

SBOM — Software Bill of Materials. A machine-readable inventory of the components in a piece of software.

CycloneDX / SPDX — the two open SBOM formats TraceGuard ingests.

Component — a single package, library, or part listed in a BOM.

CPE — Common Platform Enumeration. A standard name for a product, such as cpe:2.3:a:openssl:openssl:3.0.13:*:*:*:*:*:*:*. Advisories name the products they affect this way, so a part with a CPE can be checked. See Applicability rules and CPEs.

Vulnerability — a known weakness (e.g. a CVE) that may affect a component.

Finding — a vulnerability in the context of a specific component in a specific project. Findings are what you triage.

VEX — Vulnerability Exploitability eXchange. A statement about whether a vulnerability actually affects you: affected, not affected, fixed, or under investigation — with a justification.

KEV — CISA's Known Exploited Vulnerabilities catalog. A vulnerability in KEV is being exploited in the wild, so it's prioritized.

EPSS — Exploit Prediction Scoring System. A probability (0–1) that a vulnerability will be exploited in the near term.

Applicability rule — a rule that tells the scanner what a part is when the BOM gives no package URL or CPE, usually by giving it a CPE. It can also mark findings outside a version range as out of scope. A rule applies to scans once it is approved. See Applicability rules and CPEs.

Evidence bundle — an exportable package of proof (findings, decisions, VEX, snapshots) suitable for an auditor.

Assurance — the append-only record that ties findings and decisions together into continuous, audit-ready proof.