SBOM Agent
The SBOM Agent maintains a live, machine-readable map of every dependency, transitive package, container layer and vendored binary you ship, and continuously cross-references it against the global CVE feed. The moment a zero-day drops, the agent already knows which of your services it touches.
FIELD CONDITIONS
Most SBOMs are PDFs generated for an audit, already stale by the time they are signed. The SBOM Agent treats the bill of materials as a living graph: regenerated on every build, correlated with your runtime services, and queryable the moment a CVE lands.
CAPABILITY
The agent decomposes monorepos, container images, lockfiles, vendored binaries and infrastructure modules into one normalised SBOM in CycloneDX and SPDX. Transitive dependencies are first-class, not footnotes.
Each CVE that lands in the global feed is matched against your live SBOM, walked into your service graph, and ranked by reachability, not just whether the package is installed.
The agent proposes the minimum upgrade that resolves the CVE, runs your test suite against it, and opens a pull request with a clean diff. Engineers see the breaking change before they see the alert.
In practice
When a Log4j-class CVE drops, the agent can already tell you which services import the vulnerable package, which of those are reachable from the internet, and which have a patch available.
Reachability and runtime correlation cut the noise dramatically. A vulnerable function inside a dead-code path is not the same as one in your auth middleware, the agent knows the difference.
Auditors and customers increasingly demand a current, signed SBOM. The agent produces them on demand, in CycloneDX or SPDX, with provenance attestations attached.
Stale dependencies are tomorrow's incident. The agent surfaces upgrades quietly, in the background, and merges the safe ones, so you never inherit a five-major-version jump under pressure.
Next
Median time from a CVE landing in the global feed to the SBOM Agent flagging the affected service in your environment, with a draft upgrade PR attached.