From our work
Do you know which libraries are in your software – and which of them became vulnerable overnight?
A software inventory that re-checks every night
Starting point
The Cyber Resilience Act requires manufacturers to identify the components of their software; NIS2 requires essential and important entities to secure their supply chain. Most only learn about a new vulnerability when they happen to rebuild or someone asks.
What we did
We built our own tool for this. Projects register themselves through their CI and supply only their software bill of materials (SBOM), never source code. Every night, all SBOMs are checked against current vulnerability data. A locally run AI classifies projects and asks follow-up questions; every security finding remains deterministically traceable.
Result
A new vulnerability is spotted even if nobody has rebuilt anything. In use for our own systems.
What we learned
The AI repeats what a project's documentation claims, not where the project actually runs. That is why, for us, the finding from the running system decides, not the model's assessment: Determinism first, AI second.