These seven acronyms describe different parts of one job: knowing what software you run and deciding what to fix. VM is the process, SCA finds open source risk, ASPM organizes findings, SBOM lists ingredients, VEX says whether a flaw affects you, KEV lists exploited flaws, and EPSS estimates exploitation odds.
The glossary
| Term | Stands for | What it is |
|---|---|---|
| VM | Vulnerability management | The ongoing process of finding, ranking, fixing and verifying weaknesses |
| SCA | Software composition analysis | Scanning that identifies third party components in code and checks them for known flaws |
| ASPM | Application security posture management | A layer that gathers findings from many tools, deduplicates, adds context and ranks them |
| SBOM | Software bill of materials | A nested inventory of the components in a piece of software |
| VEX | Vulnerability Exploitability eXchange | A statement of whether a product is affected by a known vulnerability |
| KEV | Known Exploited Vulnerabilities | A CISA catalog of vulnerabilities exploited in the wild |
| EPSS | Exploit Prediction Scoring System | A daily probability that a CVE will be exploited in the next 30 days |
Definitions in a sentence each
Vulnerability management is a loop, not a product. NIST describes the patching part as identifying, ranking, obtaining, deploying and confirming fixes.
SCA works from code and builds. It reads lockfiles and artifacts, so it can see libraries a host scanner does not.
ASPM takes findings from several tools and answers a prioritization question across them. It does not usually produce its own detections.
SBOM is, in CISA's words, a list of the ingredients that make up software components. It is the inventory SCA produces and consumers read.
VEX is, per CISA, an attestation in the form of a security advisory, stating whether products are impacted by known vulnerabilities.
KEV entries carry a date added and a due date, and CISA presents the catalog as an input to prioritization.
EPSS is maintained by an EPSS special interest group at FIRST, with probabilities published daily for every CVE.
How the terms connect
- SCA produces an SBOM and a list of findings.
- ASPM merges those findings with others.
- KEV and EPSS help rank them.
- VEX records which ones do not apply to a given product.
- Vulnerability management sets the deadlines and checks the result.
Two related terms often appear alongside these. CVE is an identifier for a publicly known vulnerability. CVSS is a severity score. FIRST describes it as capturing the principal characteristics of a vulnerability, and the current version is 4.0. Severity is not the same as exploitation likelihood, which is why teams combine CVSS with KEV and EPSS.
Mix-ups worth avoiding
- An SBOM is an inventory, not a scan result. It has no vulnerability verdicts by itself.
- ASPM is not an SBOM format and not a scanner type.
- KEV is not a score. A vulnerability is either listed or not.
- EPSS is not a severity rating. A low EPSS does not make a flaw harmless.
A worked example: one vulnerability, seven terms
Imagine a new advisory for a widely used compression library. Here is where each term shows up.
- Your SCA tool scans your code and finds the library in two applications.
- The scan produces an SBOM for each, listing the library and its parents.
- You look up the CVE in the KEV catalog. It is not listed, so exploitation in the wild is not confirmed there.
- The EPSS probability is published for the CVE, and you record it.
- The CVSS score gives a severity that you note.
- ASPM merges the two findings with an image scan hit, so you see two unique issues.
- The supplier of one product you depend on publishes a VEX statement saying their product is not affected, and you use it to close a third finding.
- The VM process sets the deadline and tracks the fix to closure.
One event, many terms, and each has a clear job.
Step by step: learn the terms by using them
- Pick one application.
- Generate its SBOM and read the list of components.
- Run SCA and note the findings by CVE.
- Check KEV for each CVE.
- Look up EPSS for the rest.
- Rank the list and decide which items to fix first.
- Write down the deadline and the owner. That last step is vulnerability management.
An hour spent this way teaches more than a day of reading definitions.
Related terms you may meet
| Term | Meaning |
|---|---|
| CVE | A public identifier for a known vulnerability |
| CWE | A category of weakness, such as improper input validation |
| Reachability | Whether your code can call the vulnerable function |
| Transitive dependency | A package brought in by another package |
| Lockfile | A file recording exact resolved versions |
| Package URL | A standard way to name a component with its ecosystem and version |
Reading a finding with these terms
A well formed finding reads like a sentence: this application includes this component at this version, affected by this CVE, severity so and so, exploitation probability so and so, listed or not listed in KEV, reachable or not, with this fixed version, owned by this team, due on this date. If any part is missing, you know which term to ask about.
Why plain terms matter
Teams stall when a customer asks for an SBOM and one person thinks it means a vulnerability report. A shared glossary prevents that. Print this one, pin it in your team space and update it as new terms appear in your questionnaires.
Try it yourself
Open the demo and look at how direct and transitive components are listed for one project.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard produces SBOMs and runs dependency scanning and reachability analysis, then applies policies to the results. A free scan is at gold.safeguard.sh/scan.
Quick check
Which of these is a process rather than a tool or data source?
Vulnerability management. The others are methods, inventories, catalogs or scores that the process uses.
Does an SBOM tell me which components are vulnerable?
No. It lists components. You match it against vulnerability data, usually with SCA, to find which are affected.
Which term should I learn first?
Start with CVE and SBOM. Once you can read a list of components and the vulnerabilities attached to them, the other terms fall into place.
Sources
- CISA, Software Bill of Materials
- CISA Known Exploited Vulnerabilities Catalog
- FIRST, EPSS
- FIRST, Common Vulnerability Scoring System
- NIST SP 800-40 Rev. 4, enterprise patch management
Last reviewed: 19 October 2026.
