VulnTrek turns the SBOMs and dependency manifests you already produce into an organisation-scoped component inventory, links components to known vulnerabilities and vendor advisories, and routes the resulting work through the same risk, ticket and evidence workflow as every other finding.
Upload CycloneDX or SPDX JSON files, or a plain dependency manifest. VulnTrek parses each import into components with names, versions and package identifiers, and keeps a history of every import. It does not build SBOMs from source code or run its own composition scanner; it works with the files your build pipeline and tools generate.
Each component records how it entered your software: directly or through another dependency, and at what depth. That makes it possible to tell a library your team chose from one it inherited several layers down, which changes who can fix it and how.
Components are matched to known vulnerabilities and vendor advisories, and linked to the applications that use them. A match is a signal to investigate, not proof that vulnerable code is reachable in your product; matching depends on the identifiers your SBOMs contain.
Component findings join the shared intake, so duplicates are merged, risk is scored with business context, owners are assigned and tickets are synced to your tracker. People approve external changes, and closure needs a reason and evidence recorded in append-only history.
VulnTrek is the management and correlation layer, not a scanner. It does not generate SBOMs, analyse source code or prove reachability. Results depend on the completeness and accuracy of the SBOMs and manifests you import. AI suggestions are advisory only.
This public page describes the product only. Your components, SBOM imports, findings and evidence stay inside your organisation's signed-in workspace, isolated from every other customer.
When a new library vulnerability is announced, search the component inventory to see which applications include that package and version, instead of asking every team.
Ask suppliers for an SBOM, import it, and review the components and known vulnerabilities before or after you deploy their software.
Use dependency depth and application mapping to decide which transitive issues matter and which team is best placed to upgrade the parent package.
Retain import history, decisions and closure evidence per organisation, ready for internal review. Regulatory mappings are presentation-only and do not certify your organisation.
Software supply chain features are part of the VulnTrek platform. Any price, term or billing schedule is confirmed in a written quote before purchase.