01
Understand software composition
Use a Software Bill of Materials (SBOM) and Software Composition Analysis (SCA) to connect CycloneDX component information and package identifiers (PURL) with vulnerability evidence.
WERANA / Services
Vulnerability analysis
Know what is inside.Decide what to fix first.
Analyze image and OS-package SBOM components alongside related CVEs, affected assets, exploitation signals, and fixed versions.
Review workflow
Review components and affected assets before acting.
Look beyond vulnerability counts. Compare exploitation evidence and available fixes to focus remediation review.
- 01Images & packages
- 02SBOM & CVEs
- 03Impact & fixes
02
Consider exploitation and impact
Distinguish CVE identifiers, CVSS severity, EPSS exploitation probability and CISA KEV exploitation history. Review CWE weakness types and collected CPE product identifiers as supporting information.
03
Review fixes and compensating actions
For Vulnerability Management, compare installed and fixed versions, patch availability and affected assets. Distinguish CPE-based network-service and OS matching from precise package analysis when reviewing remediation.
Environment & coverage
What can you review in your environment?
Review the applicable scope based on your assets, collection permissions, and existing security operations.
Security categories to compareSCA · SBOM · SPDX · VEX · Vulnerability Management
Vulnerability analysis
Analysis covers collected container images and OS packages, subject to available vulnerability information.
What to discuss
- Container-image and OS-package collection
- SBOM, CVE, and affected-asset relationships
- Available exploitation and fixed-version information
FAQ
Frequently asked questions
Which software components are analyzed?
Review components, CVEs, and affected assets based on collected container images and OS packages.
How do SBOM, SCA and CycloneDX differ from SPDX and VEX?
SBOM describes software components; SCA analyzes them; and CycloneDX and SPDX are formats used for SBOMs. VEX communicates whether a vulnerability affects a specific product. Werana Point Connection describes CycloneDX-based image and OS-package analysis here. Confirm SPDX import and export, VEX processing and license-management coverage separately.
How should we use CVSS, EPSS and CISA KEV to prioritize remediation?
CVSS describes severity, EPSS predicts exploitation likelihood, and CISA KEV records known exploitation. Consider available indicators alongside affected assets, exposure and fixed versions. CWE, CPE and PURL identify weakness types, products and packages respectively. Missing scores do not establish safety.
Start with the scope that fits your environment.
Tell us about your environment and security priorities. We will help review supported capabilities and collection requirements.