Software supply chain security has its own vocabulary, and most terms have simple meanings. This glossary gives fifteen of them in plain English, with one line on why each matters to a leader, a buyer or a lawyer sitting in on an engineering conversation.
The terms
| Term | Plain meaning | Why it matters |
|---|---|---|
| Dependency | A piece of code your software needs from someone else | Each one is a supplier |
| Direct dependency | One engineers chose on purpose | Easiest to review |
| Transitive dependency | One pulled in by another dependency | Often where hidden flaws sit |
| Lockfile | A file recording exact versions used | Makes builds repeatable |
| SBOM | A nested inventory of software components | Answers "do we use this?" |
| Vulnerability | A flaw that could be misused | Raw material for attacks |
| CVE | A public identifier for a known flaw | Lets everyone refer to the same issue |
| CVSS | A severity score for a flaw | Severity, not risk |
| KEV | CISA list of flaws exploited in real attacks | A short priority list |
| EPSS | An estimate of the chance a flaw is exploited soon | Helps rank the long list |
| Reachability | Whether your code actually uses the flawed part | Cuts false alarms |
| VEX | A statement on whether a product is affected by a flaw | Lets a vendor say "not affected" |
| Provenance | Evidence of how and where software was built | Supports trust in what you received |
| Build pipeline | The automated line that turns code into a product | A target in its own right |
| Typosquatting | A fake package with a name close to a real one | Tricks people and tools into installing it |
How the terms fit together
Start with dependencies, since they are the parts. An SBOM lists them. A CVE names a flaw that may sit in one. CVSS, KEV and EPSS help rank flaws, and reachability tests whether your code even touches the weak spot. VEX is how a supplier communicates that result. Provenance and the build pipeline cover how the finished product was made.
What each source says
CISA describes an SBOM as a nested inventory and VEX as an attestation about whether products are affected by known vulnerabilities. FIRST describes CVSS as measuring severity and EPSS as estimating the probability of exploitation in the next 30 days. CISA describes KEV as the authoritative source of flaws exploited in the wild. The SLSA project describes provenance as tamper resistant evidence about how software was produced.
Using the glossary
Print it for the next risk meeting. When a term appears that is not here, ask the speaker to explain it in one sentence. If they cannot, that is useful information.
Where Safeguard fits
Safeguard produces SBOMs and scans dependencies, and its reachability analysis shows which findings your code actually uses. You can run a free scan on a repository to see an inventory for yourself.
Try it yourself
Find a dependency and a transitive dependency in the inventory and match each to its row in the glossary.
Click through it at your own pace, or open it full screen.
Quick check
Which three terms matter most to start?
Dependency, SBOM and reachability. Together they cover what you use, how you list it, and whether it matters.
Is a CVE the same as a vulnerability?
A CVE is an identifier for a publicly known vulnerability. The vulnerability is the flaw itself.
Sources
- CISA, Software Bill of Materials
- FIRST, CVSS v4.0 User Guide
- FIRST, Exploit Prediction Scoring System
- CISA, Known Exploited Vulnerabilities Catalog
- SLSA, About
Last reviewed: 19 October 2026.
