When a supplier sends a CycloneDX or SPDX SBOM, a quick scan tells you which components carry known vulnerabilities, and gives you specific questions to put back to the supplier. It does not prove the SBOM is complete or that the software is safe. Treat it as a first filter.
Why scan it at all
CISA describes an SBOM as a nested inventory, a list of the ingredients that make up software. A list alone is not an assessment. Matching those components against known vulnerability data turns an inventory into questions you can ask.
Step by step
- Confirm the format. The free scan accepts CycloneDX and SPDX SBOMs, along with package.json and requirements.txt.
- Count the components. The scan checks up to 100 dependencies per run, so a large SBOM needs splitting or a different tool.
- Paste or upload the file. Files are parsed in your browser, with no account, per the page.
- Note every package that shows known vulnerabilities.
- Open the Gold page for each hit to read the CVE, fix status and severity.
Questions to send back
For each finding, ask the supplier:
- Is this component in the shipped product, or only in build tooling?
- Is the vulnerable function reachable in your product?
- Is there a fix, and when will it ship?
- Do you publish a VEX statement for it?
CISA describes VEX as an attestation that says whether a product is affected by known vulnerabilities. A supplier who can answer with VEX has done the work. A supplier who cannot may not know yet, which is also information.
What the scan cannot tell you
Completeness. If a component is missing from the SBOM, the scan will not find it.
Accuracy of versions. The result is only as good as the versions listed.
Exploitability. A lookup finds known vulnerabilities, not whether your usage is exposed.
Quality of the file itself. For field level checks, see the post on /resources/blog/check-supplier-sbom-against-minimum-elements.
Record the result
Keep the SBOM, the scan date and the list of findings with the supplier record. Rerun when the supplier ships an update or when a major new advisory lands.
Safeguard's SBOM and dependency scanning handle this at scale, and the free scan is at gold.safeguard.sh/scan.
Quick check
Is a clean scan a reason to approve a supplier?
No. It means no known vulnerabilities were matched for the components listed. Completeness, process and contract terms still need review.
Sources
Last reviewed: 19 October 2026.
