Enterprise Software Supply Chain Manager, or ESSCM, is the umbrella product for the core workflow. This post lists the steps as the product page gives them, in order.
What it is
The page describes a product for finding, fixing and preventing vulnerabilities in software supply chains. It lists Gold components (early access), an IDE extension for VS Code, IntelliJ and PyCharm, transitive analysis with reachability, autonomous fixes by Griffin AI with optional policy gated auto-merge, cloud, on-prem and air-gapped deployment with a CLI, CycloneDX and SPDX SBOMs with SLSA provenance, and enterprise operations such as a policy engine, risk scoring, SLA tracking, an audit trail and SSO.
The workflow
- Connect your source control platform through an app install.
- Discover repositories, registries and CI pipelines.
- Scan with eleven scanners in parallel.
- Assess reachability and enrich findings from vulnerability databases.
- Evaluate findings against a policy bundle that passes, warns or fails the pipeline.
- Open auto-fix pull requests for supported ecosystems after running your test suite.
- Record every decision and action in an audit log.
How to use it
Do steps one to three on a single repository, then read the policy result before enabling anything automatic. Turn on auto-merge last, and only for a class of change you already merge without debate.
What to verify
The page mixes designed for and compliant wording for several frameworks, and gives remediation timing and savings with no method. Verify status and numbers directly before you repeat them.
Quick check
What happens at the policy step?
Findings are evaluated against a bundle that passes, warns or fails the pipeline.
