Security glossary
The supply-chain and vulnerability terms that actually come up in a security program — defined in one sentence each, then linked to a deeper guide. No marketing, just what the term means and why it matters.
Bill of Materials (xBOM)
A Bill of Materials is a machine-readable inventory of what a system is built from. The family below extends the idea from software dependencies to cryptography, AI, hardware, and post-quantum risk — each answering a different regulatory and security question.
- SBOM (Software Bill of Materials)
- An SBOM is a formal, machine-readable inventory of every software component in an application — direct and transitive dependencies, their versions, suppliers, and licenses.It is the base artifact regulators now ask for (US EO 14028, EU CRA, CERT-In). Standard formats are CycloneDX and SPDX.Full guide
- CBOM (Cryptographic Bill of Materials)
- A CBOM is an inventory of every cryptographic asset a system uses — algorithms, key lengths, certificates, protocols, and where each is used.It exists to drive post-quantum migration: you cannot replace quantum-vulnerable crypto (RSA, ECC) until you know where it lives. CycloneDX added a dedicated CBOM extension.Full guide
- AIBOM (AI Bill of Materials)
- An AIBOM is an inventory of every component in an AI system — models, training and fine-tuning datasets, weights, and their licenses and provenance.A normal SBOM misses the model and data supply chain, which is where AI-specific risk (poisoned data, unlicensed weights, model provenance) actually sits. Formats: CycloneDX ML-BOM and SPDX 3.0.Full guide
- QBOM (Quantum Bill of Materials)
- A QBOM extends a CBOM with quantum-risk context: which cryptographic assets are vulnerable to a quantum computer, and the estimated timeline for that risk.It turns a crypto inventory into a prioritized post-quantum migration plan aligned to NIST PQC and CNSA 2.0 deadlines.Full guide
- HBOM (Hardware Bill of Materials)
- An HBOM is an inventory of the physical and firmware components in a device — chips, boards, embedded firmware, and their suppliers.It extends supply-chain transparency to hardware and firmware, where component substitution and counterfeit-part risk live.Full guide
What is SBOM?
What is CBOM?
What is AIBOM?
What is QBOM?
What is HBOM?
Vulnerability & exploitation
The signals that decide whether a vulnerability actually matters to you — as opposed to merely existing in a dependency.
- CVE (Common Vulnerabilities and Exposures)
- A CVE is a unique public identifier for one specific security vulnerability, assigned so that everyone refers to the same flaw by the same ID (e.g. CVE-2021-44228).The ID itself carries no severity — that comes from CVSS, and real-world risk from EPSS, CISA KEV, and reachability.Full guide
- CVSS (Common Vulnerability Scoring System)
- CVSS is a 0–10 score describing how damaging a vulnerability would be if exploited — its severity, not its likelihood.A high CVSS alone does not mean you are in danger; pair it with EPSS (likelihood) and KEV (active exploitation) to prioritize.Full guide
- EPSS (Exploit Prediction Scoring System)
- EPSS is a probability, from 0 to 100%, that a vulnerability will be exploited in the wild within the next 30 days.Maintained by FIRST.org, it cuts through the noise: most CVEs are never exploited, and EPSS surfaces the small set that likely will be.Full guide
- CISA KEV (Known Exploited Vulnerabilities)
- CISA's KEV catalog is the US government's list of vulnerabilities confirmed to be actively exploited in the real world.A KEV listing is the strongest possible signal of active exploitation — US federal agencies must remediate anything on it by a set deadline.Full guide
- Reachability analysis
- Reachability analysis determines whether a vulnerable code path is actually invoked from your application — so you fix the CVEs that touch your code, not every transitive match.It is the difference between "vulnerable dependency present" and "vulnerability exploitable here," which is what makes SCA results actionable instead of noise.Full guide
What is CVE?
What is CVSS?
What is EPSS?
What is CISA KEV?
What is reachability analysis?
Supply chain & malware
The attack surface between a developer typing code and it running in production.
- Software supply chain attack
- A software supply chain attack compromises a trusted component — a dependency, build tool, or update channel — so that malicious code reaches downstream users through a legitimate path.Examples range from a typosquatted npm package to a tampered build pipeline. Defense spans the whole path: code, build, and runtime.Full guide
- Malicious package
- A malicious package is a library published to a registry (npm, PyPI, and others) that contains code designed to harm anyone who installs it — stealing credentials, opening a backdoor, or exfiltrating data.Often delivered via typosquatting or a compromised maintainer account; frequently no CVE is ever assigned.Full guide
- Typosquatting
- Typosquatting is publishing a malicious package under a name that closely mimics a popular one (e.g. a one-character difference) to catch developers who mistype the dependency.Full guide
- SLSA (Supply-chain Levels for Software Artifacts)
- SLSA is a framework of security levels (L1–L3+) describing how tamper-resistant a software build and its provenance are.SLSA L3 requires signed, verifiable build provenance (e.g. via cosign) proving an artifact was built from the expected source by a hardened pipeline.Full guide
What is software supply chain attack?
What is malicious package?
What is typosquatting?
What is SLSA?