Record a closed-source vendor binary by hand with its supplier name, product name, exact version, file hash, where it came from, what it does in your product, and where the supplier publishes security notices. Scanners cannot read inside it, so a careful manual entry is the inventory.
Why binaries are the gap
Package-based scanning works because package managers publish names and versions. A Bluetooth stack, a modem firmware or a driver pack delivered as a binary has none of that. Yet these pieces handle radio traffic from untrusted sources, which is where serious flaws tend to live. If they are not in your inventory, an advisory about them will not match anything you own.
Annex I Part II point 1 of the Cyber Resilience Act speaks of identifying and documenting components, including by drawing up an SBOM in a machine-readable format covering at least top-level dependencies. A vendor binary that is part of your product is a top-level component. Treat it that way.
The record, field by field
| Field | Example form | Why it matters |
|---|---|---|
| Supplier | Company name | Who to ask |
| Component name | As the supplier labels it | Matching advisories |
| Version | Exact string from the file or release notes | Affected or not |
| Hash | SHA-256 of the file you ship | Proves which build |
| Source of delivery | Portal, email, contract reference | Provenance |
| Role in product | Radio, boot, storage | Exposure |
| Update path | How you receive and ship a fix | Time to fix |
| Advisory source | URL or mailing list | Intake |
| Support end | Date or unknown | Planning |
If the file has no version string, ask the supplier. If they cannot say, record that fact, because it is a risk.
Steps to build the habit
- Create one entry per binary the day it enters the repository.
- Store the supplier's licence and release notes next to the file.
- Put the entry into the SBOM through a supplementary file your tooling can merge.
- Add the supplier's advisory feed to your intake list.
- Review entries whenever the supplier releases a new drop.
Ask the supplier three questions
How do you notify customers of security fixes? How long is each version supported? Can you provide an SBOM for the binary? Keep the written answers. A vendor who will not answer is useful information for the next design decision.
What not to do
Do not guess a version from a date. Do not list the component under your own product name. Do not leave it out because the scanner could not find it. Gaps in an SBOM look like safety and are the opposite.
Try it yourself
Click through it at your own pace, or open it full screen. Compare an automatic inventory with the entries you must add by hand.
Quick check
Can a scanner identify a vendor binary?
Sometimes by hash or by strings, but you should not rely on it. Record it yourself.
Do we need the supplier's own SBOM?
It is useful and worth asking for. If they do not have one, record what you know and note the gap.
Sources
Last reviewed: 19 October 2026.
