Manifest Platform

Generates documentation artifacts for EU AI Act conformity assessment and NIST AI RMF profile, mapping AI system inventory and controls to applicable requirements.

Discovers and catalogs AI models, LLM API connections, ML pipelines, training datasets, and AI-enabled SaaS applications in use across the organization, including unauthorized deployments.

Exports AI system inventories in SPDX AI extension or CycloneDX ML profile format for downstream consumption by compliance tools, procurement workflows, and regulators.

Records the origin, training data sources, and modification history of AI models, supporting integrity verification and accountability for AI system behavior.

Evaluates open-weight and custom models and other AI components against organization policies on country of origin, license, training-data transparency, model age and dependency vulnerabilities, flagging violations in notebooks and CI before deployment.

Searches the organization-wide SBOM inventory by component, version or CVE and returns the affected products, projects and environments, so a newly disclosed vulnerability or a suspect package can be traced to everywhere it ships.

Creates, imports, and manages Vulnerability Exploitability eXchange statements asserting the exploitability status of CVEs for specific product versions, reducing false positive noise for downstream consumers.

Generates SBOMs from source code analysis (via build system integration), and from binary analysis (via binary composition analysis), the latter enabling SBOM generation for third-party software where source is unavailable.

Normalizes ingested SBOMs to the CISA minimum elements by resolving missing or inaccurate component identifiers such as PURL and CPE and dependency relationships, and enriches components with license, supplier and support metadata, so SBOMs from any generator can be analyzed for third-party risk consistently.

Generates formatted evidence packages for SBOM-related regulatory requirements: FDA pre-market cybersecurity guidance, Executive Order 14028 SBOM requirements, EU Cyber Resilience Act Article 13.

Validates imported SBOMs against minimum-element requirements (NTIA baseline and successor CISA guidance), flagging missing supplier names, versions, unique identifiers, and dependency relationships before the SBOM is exchanged or submitted as regulatory evidence. Checks declared data-field completeness rather than verifying declarations against compiled binaries.

Tracks the support level and end-of-support date of each SBOM component, flagging components that will lose security maintenance while the product is still on the market. Covers the two per-component elements FDA premarket cybersecurity guidance requires beyond the NTIA baseline.

Tracks license obligations across the SBOM inventory, identifying GPL and AGPL copyleft propagation, license conflicts, and FOSS obligations for each release.

Manages the SBOM life cycle including discovery, access and secure exchange between software suppliers and consumers.

Monitors SBOMs against live vulnerability feeds, alerts when new CVEs affect components in managed SBOMs. Latency to alert after new CVE publication varies.

Imports and exports SBOMs in CycloneDX, SPDX, and SWID formats, enabling interoperability with scan tools, procurement workflows, and regulatory evidence systems.

Determines whether a vulnerable function is actually reachable and invoked, not merely present in the dependency tree, cutting actionable CVEs down to those with real exploit paths. Delivered either statically, by call-graph analysis layered on dependency scanning, or at runtime, by instrumenting the workload to observe which components actually execute.

Identifies OSS licenses in the dependency tree and flags conflicts with the project's target license or policy (GPL contamination, copyleft obligations, export-controlled components). Separate from vulnerability detection.

Traverses the full dependency graph to surface CVEs in indirect dependencies, packages required by your direct dependencies. Direct-only scanning misses the majority of vulnerable code paths in modern polyglot projects.

Identifies open source and third-party components in compiled binaries and closed-source artifacts where no package manifest exists.

Defines open source policies (banned licenses, blocked packages, version floors, severity gates) as version-controlled rules applied automatically at scan time across repositories.

Imports or generates Vulnerability Exploitability eXchange documents asserting whether a known CVE actually affects a given product in its deployed context, including statements derived from reachability analysis so an SBOM ships with evidence-backed exploitability. Reduces false positives in downstream consumers of SBOMs.

Scores open source dependency health using release cadence, maintainer count, contributor reputation, and popularity, flagging abandoned packages beyond known CVEs.

Prioritizes dependency vulnerabilities using exploitation signals such as EPSS probability and the CISA Known Exploited Vulnerabilities catalog, ranking findings by real-world exploitation likelihood rather than CVSS severity alone.

Exports the dependency inventory as a machine-readable Software Bill of Materials in SPDX or CycloneDX format, consumable by downstream vulnerability scanners, compliance tools, and procurement workflows.