Manifest Platform

What it does

Manifest Platform is a software and Artificial Intelligence (AI) supply chain security platform that manages the Software Bill of Materials (SBOM) and AI Bill of Materials (AIBOM) lifecycle through Product Security, Supplier Risk, and AI Risk modules. It generates SPDX and CycloneDX SBOMs from source, containers, disk images, and binaries, enriched with license and end-of-support data. AI Risk extends the inventory to open-weight models, datasets, and shadow AI under governance policies, and Foreign Risk screens open source contributors for foreign ownership, control, or influence.

How it works

SBOMs arrive via the CLI, GitHub App, CI pipelines, upload, or a supplier portal, validated and healed on ingest; binaries up to 2 GB are analyzed when no SBOM exists. Components are matched against NVD, OSV, and the CISA Known Exploited Vulnerabilities catalog; each finding gets a Mitigate, Monitor, or Accept action from a Stakeholder-Specific Vulnerability Categorization model weighing exploitation status, EPSS, and code reachability. Product hierarchies roll vulnerabilities up, Vulnerability Exploitability eXchange (VEX) documents in CSAF or OpenVEX record dispositions, and the Manifest Insights Agent returns blast radius reports from any indicator list via chat or MCP.

Credentials and traction

Manifest holds FedRAMP High authorization, announced in January 2025 through Palantir Technologies, and maintains SOC 2, Department of Defense Impact Level 5 (IL5), NIST 800-171, and GDPR compliance. The company won four Department of Defense pilots in 2024 and partners with Space ISAC (2024), Auto-ISAC (2025), and the Automotive Security Research Group (2025). Shift5 automates SBOM delivery across regulatory frameworks on the platform, and customers span federal agencies, defense contractors, medical device manufacturers, and Fortune 500 enterprises.