An SBOM answers "what is in the product." A VEX answers "is the product affected by this vulnerability." A questionnaire or an independent audit report answers "what controls do you run." Sending the wrong one wastes the buyer's time and can overstate what you have shown.
The routing table
| Buyer asks | Send | Why |
|---|---|---|
| What components are in your software? | SBOM | An ingredients list with versions and producers |
| Are you affected by this specific vulnerability? | VEX or advisory | States affected, fixed, not affected or under investigation |
| What controls do you operate? | Security questionnaire answers or an independent report if you have one | Describes practices, not components |
| How do you handle new vulnerabilities? | A written process | Neither an SBOM nor VEX describes your process |
| Can we scan your software ourselves? | SBOM, with terms | Gives them what they need to match advisories |
What each document is, in the sources' words
CISA's 2026 minimum elements call an SBOM a nested inventory, a list of ingredients that make up software. They add that an SBOM alone is data about components, and that analysis turns data into insight.
CISA's minimum requirements for VEX describe VEX as indicating the status of a product or component with respect to a vulnerability. The four status values are not affected, affected, fixed and under investigation. The same document says it does not impose or mandate compliance.
The 2026 SBOM text also notes that advisories such as VEX and CSAF can narrow the scope of at risk components, which is how the two documents work together.
Common mismatches
- Sending an SBOM to answer "are you affected by X." The buyer must now match it themselves and may draw the wrong conclusion. Send a status.
- Sending a VEX without an SBOM or product context. VEX is designed to integrate with SBOMs, but CISA says it does not require one. A VEX alone can still answer a specific question.
- Sending a questionnaire answer to a components question. Controls do not show what is in the build.
- Sending an audit report to a vulnerability question. A report describes controls over a period or point in time, not the status of one CVE.
A reply pattern for sales
- Restate the question in one line.
- Name the document that answers it.
- Attach it or say when it will arrive.
- Say what it does not cover and which document does.
This matters most when a buyer asks a compound question in one email. Split it, answer each part with the right artifact, and keep the replies in one thread.
Careful with claims
Do not describe any report as a certification unless it is one. Do not call a work in progress complete. If an audit is underway, say that in plain words and offer the evidence you have today. When you cite a standard or contract term, quote the exact text.
Try it yourself
Open the demo and compare a component that is merely present with one that is actually exploitable. That difference is the difference between an SBOM answer and a VEX answer.
Click through it at your own pace, or open it full screen.
Quick check
Do we need an SBOM to publish a VEX?
No. CISA says VEX is designed to integrate with SBOMs but does not require them.
Is an SBOM evidence of good security?
It is evidence of what is in the product. It does not show how you manage risk.
Safeguard's SBOM and dependency scanning and reachability analysis support both the component list and the exploitability story, and the free scan lets you try it.
Sources
- 2026 Minimum Elements for a Software Bill of Materials (SBOM), CISA and partners, 29 July 2026
- Minimum Requirements for Vulnerability Exploitability eXchange (VEX), CISA, April 2023
Last reviewed: 19 October 2026.
