Manifest Cyber SBOM Platform

Identifies hardcoded credentials, API keys, tokens, and private keys in source files. Operates on the repository and commit history, not at runtime.

Identifies packages with known-malicious behavior (typosquatting, dependency confusion, backdoored releases), distinct from packages with CVEs in legitimate code.

Imports or generates Vulnerability Exploitability eXchange documents asserting whether a known CVE actually affects a given product in its deployed context. Reduces false positives in downstream consumers of SBOMs.

Traverses the full dependency graph to surface CVEs in indirect dependencies, packages required by your direct dependencies. Direct-only scanning misses the majority of vulnerable code paths in modern polyglot projects.

Identifies OSS licenses in the dependency tree and flags conflicts with the project's target license or policy (GPL contamination, copyleft obligations, export-controlled components). Separate from vulnerability detection.

Exports the dependency inventory as a machine-readable Software Bill of Materials in SPDX or CycloneDX format, consumable by downstream vulnerability scanners, compliance tools, and procurement workflows.

Prioritizes dependency vulnerabilities using exploitation signals such as EPSS probability and the CISA Known Exploited Vulnerabilities catalog, ranking findings by real-world exploitation likelihood rather than CVSS severity alone.

Identifies open source and third-party components in compiled binaries and closed-source artifacts where no package manifest exists.

Defines open source policies (banned licenses, blocked packages, version floors, severity gates) as version-controlled rules applied automatically at scan time across repositories.

Scores open source dependency health using release cadence, maintainer count, contributor reputation, and popularity, flagging abandoned packages beyond known CVEs.

Discovers and catalogs AI models, LLM API connections, ML pipelines, training datasets, and AI-enabled SaaS applications in use across the organization, including unauthorized deployments.

Exports AI system inventories in SPDX AI extension or CycloneDX ML profile format for downstream consumption by compliance tools, procurement workflows, and regulators.

Records the origin, training data sources, and modification history of AI models, supporting integrity verification and accountability for AI system behavior.

Generates documentation artifacts for EU AI Act conformity assessment and NIST AI RMF profile, mapping AI system inventory and controls to applicable requirements.