Question 1

Does SafeSource Lab include an SBOM generator?

Accepted Answer

Yes. SafeSource Lab generates a Software Bill of Materials (SBOM) at build time in CycloneDX and SPDX formats, including for embedded and vendored C/C++ code that manifest-based tools miss.

Question 2

Is there a vulnerability scanner for embedded and connected products?

Accepted Answer

Yes. SafeSource Lab performs software composition analysis (SCA) and binary vulnerability analysis, correlates components against CVEs, and prioritizes findings with EPSS and KEV — designed for OT/IoT products with long lifecycles.

Question 3

Which SBOM formats and security standards does SafeSource Lab support?

Accepted Answer

CycloneDX and SPDX SBOMs; CVE/NVD, EPSS and KEV for prioritization; VEX and CSAF for disclosure — aligned with the EU Cyber Resilience Act (CRA) and IEC 62443-4-1 and 4-2.