How do you review a vendor's SBOM with Safeguard?

To review a vendor's SBOM, validate the file's format and fields, scan it against known vulnerabilities, then ask follow-up questions in the Safeguard web app chat. The docs we reviewed do not describe attaching a file inside chat, so use the CLI or the free browser scan for intake and chat for the questions.

Step 1: is it a real SBOM?

Before any scanning, test the file.

• Format. It should be SPDX or CycloneDX, which are the two common standards. The Safeguard CLI has a validate command that checks an SBOM against both specifications.
• Fields. The NTIA baseline per component is supplier, component name, version, other unique identifiers, dependency relationship, author of SBOM data, and timestamp. Sample twenty components. If suppliers and identifiers are mostly blank, the file will not match well to vulnerability data.
• Freshness. Check the timestamp against the release you are buying. An old file describes an old product.
• Depth. Do you see transitive dependencies, or only top level packages?

If it fails here, send it back with the specific gaps. That is a normal request.

Step 2: what is in it that is known to be flawed?

You have two supported intake routes.

Free browser scan. Gold Open Source offers a free scan at gold.safeguard.sh/scan. You paste or upload a manifest or a CycloneDX or SPDX SBOM. It checks up to 100 dependencies, parses the file in your browser, and says nothing leaves the browser. It needs no login. Use it for a quick first look at a small file.

CLI. The scan command accepts an existing SBOM file as input and matches it against the advisory database, writing vulnerability and license results to an output folder. Use it for full size files.

Step 3: how do you ask the chat about the results?

The Griffin chat in the web app takes plain questions about your security posture. The docs give examples such as asking what your biggest risk is, comparing the last two scans, requesting an executive summary, and asking how to fix an issue to get step by step remediation guidance. Griffin is available in the Third Party Risk Manager, among other products, and the docs state that customer code is not stored or used for training.

Questions that suit a vendor review:

• Which findings are critical or known to be exploited?
• Which of the flagged components have a fixed version available?
• How does this scan compare with the vendor's previous release?
• Give me a summary I can send to the vendor.

Treat answers as a starting point, and check important claims against the underlying results.

Step 4: what do you send back to the vendor?

A good response is specific and short:

1. The component, version and identifier of each concern.
2. Whether you need a fix, a mitigation or a statement that the flaw is not exploitable in their product.
3. A date for a reply.

A vendor can answer a "not affected" claim with a VEX document. CISA published minimum requirements for VEX in April 2023, so you can ask for one in that shape.

What to do

1. Validate format, fields, freshness and depth before scanning.
2. Run a quick browser scan for small files, or the CLI for large ones.
3. Ask chat for the highest risks and for fixes available.
4. Verify any important answer against the result files.
5. Send the vendor a specific list with a reply date.
6. File the SBOM, the results and the reply together as vendor evidence.

Quick check

Sources

• Safeguard docs: Griffin AI
• Gold Open Source: free scan
• Safeguard CLI
• NTIA: The Minimum Elements for a Software Bill of Materials (PDF)
• CISA: Minimum Requirements for VEX

Last reviewed: 18 October 2026.