Articles Tagged SBOM
All GeekWala articles tagged SBOM.
DORA ICT Third-Party Risk & Open-Source Dependencies
DORA's ICT risk-management and third-party-risk articles don't mention open-source dependencies by name, but they cover them. This guide translates Articles 6, 28, and 30 into a concrete scanning baseline: inventory, SBOM, exploitability triage, and reporting.
NIS2 Supply Chain Security Requirements Explained
NIS2 Article 21 requires essential and important entities to secure their supply chain, including software dependencies. This guide translates Article 21(2)(d) and (e) into concrete evidence: SBOMs, scan cadence, and vulnerability-handling records.
EU CRA CE Marking: The December 11, 2027 Deadline
September 2026 is the CRA's reporting deadline. December 11, 2027 is the bigger one: mandatory CE marking, essential cybersecurity requirements, and formal conformity assessment for every in-scope product. What changes, which tier your product falls into, and how to prepare.
EU CRA Reporting Obligations: Article 14 Now in Force
Most EU Cyber Resilience Act coverage points at the December 2027 deadline. The obligation that landed first — 24-hour reporting of actively exploited vulnerabilities — has applied since September 11, 2026. Here's how the reporting regime works and who it applies to.
GeekWala vs Grype: Beyond CLI Scanning
Grype is one of the best CLI-based vulnerability scanners available, with genuine EPSS and CISA KEV support built in. But it's CLI-only. GeekWala serves teams that need a web UI, project history, and scheduled re-scans — not just CI/CD engineers who are comfortable with JSON output.
What Is VEX? Vulnerability Exploitability
Your SBOM says you use a vulnerable package. But does the vulnerability actually affect your product? VEX answers that question with a machine-readable document that states whether a known CVE is exploitable, not affected, under investigation, or fixed in your specific product.
SBOM Scanning Tools 2026: EU CRA Guide
EU CRA's September 2026 deadline requires 24-hour reporting of actively exploited vulnerabilities. You can't meet that deadline without SBOM tooling. This guide covers which tools generate and scan SBOMs, handle EU CRA workflows, and fit your team size and budget.
Software Supply Chain Security for Developers
Supply chain attacks doubled in 2025, most often through compromised dependencies. This guide covers the practical security layers — dependency scanning, SBOM generation, vulnerability triage, and CI/CD hardening — that protect your software without slowing your team down.
SBOM Requirements 2026: Developer Checklist
The EU CRA vulnerability reporting deadline is September 2026. Here's the checklist your team needs to be ready — organized into two phases with specific action items for each.
SBOM Scanning and the EU Cyber Resilience Act
Starting September 2026, the EU Cyber Resilience Act requires vulnerability and incident reporting for software sold in Europe. By December 2027, you'll need a machine-readable Software Bill of Materials. If your software has open-source dependencies — and it does — this directly affects you.