SBOMSentinel

SBOMSentinel is a web app (with optional desktop agent) that helps government security teams validate Software Bills of Materials (SBOMs) from vendors and internal builds, then turn them into actionable risk decisions. It ingests SPDX/CycloneDX SBOMs, normalizes components, and continuously checks them against known-vuln and exploited-vuln sources, license red flags, and end-of-life signals. The app produces procurement-friendly risk summaries, waiver workflows, and audit-ready evidence packages aligned to common federal expectations (e.g., EO 14028, NIST guidance). An AI assistant can draft vendor questions, summarize deltas between SBOM versions, and explain why a component is risky in plain language—without pretending to replace human approval. Realistically, the hard part isn’t scanning; it’s making SBOM data trustworthy, comparable, and usable for acquisition and ATO documentation. This focuses on that operational gap.