The SBOM
System of Record

An SBOM system of record is a single governed platform for ingesting, managing, monitoring, and sharing every SBOM across your products and suppliers. It differs from generation tools and static repositories by keeping SBOM data accurate, continuously monitored, and audit-ready: one source of truth you can prove on demand to customers, auditors, and regulators.

RAVEN stands for Reachability, Agentic, VEX automation, Evidence, and No exposure. Agents confirm whether a vulnerable code path can actually execute in your build, work through the coding agents you already run, return every finding as a reasoned VEX statement, write every answer to the audit trail, and never move your source code or internal documents out of your environment.

The intelligence layer is the fourth layer of the model, above Generate, Store, and Govern. The system of record is the memory: every SBOM, vulnerability, and gap in one governed place. Raven adds the thought: an AI layer that reasons through business and codebase context and turns a scored vulnerability list into a triage decision.

Generation tools answer what is inside one build today. Repositories answer where the SBOM file is stored. A system of record answers where you are exposed across every product and supplier, and whether you can prove it. All three layers are necessary; regulatory obligations are managed in the system of record.

No. Raven works through the coding agents already inside your environment through a governed interface: questions go in, evidence comes out, and nothing else crosses. That applies to everything Raven can reach, not only code. Source code, internal documents, specifications, design and architecture records, threat models, and schematics all stay inside your environment.

Only the reasoned answer leaves the boundary, and every one of those is written to the audit trail, linked to the exact component, product, and version.

The EU Cyber Resilience Act sets staged reporting deadlines for an actively exploited vulnerability: an early warning within 24 hours and a vulnerability notification within 72 hours of becoming aware of it, then a final report no later than 14 days after a corrective or mitigating measure is available (Regulation (EU) 2024/2847, Article 14(2)). Raven confirms reachability, drafts the VEX statement, and assembles audit-ready evidence at machine speed, so your team can review and report within each window instead of assembling the analysis manually.

What the CRA requires of the SBOM itself, its format, depth and fields, is set out in EU CRA SBOM requirements.

No. Raven is an SBOM Studio add-on, not another scanner, and it requires no new access. SBOM Studio already monitors every component against continuous vulnerability intelligence on quality-scored SBOMs, which keeps false positives low. That means Raven starts from high-quality, already-correlated data rather than raw scanner noise, works through the coding agents your engineers already run, and returns findings as reasoned VEX statements ready for your team to confirm.

Raven is built for Product Security Officers (PSOs), Chief Product Security Officers (CPSOs), PSIRTs, CSOs, and product security and governance leaders responsible for software supply chain security and compliance. These teams typically own the product-security workflows supported by SBOM Studio, while CISO teams may use SBOM Consumer capabilities for broader third-party risk and asset-management use cases.