Nexus One Platform

Determines whether a vulnerable function is actually reachable and called in the codebase: not merely present in the dependency tree. Reduces actionable CVEs to those with real exploit paths; requires static code analysis on top of dependency scanning.

Opens PRs with upgraded dependency versions that resolve CVEs. Quality differentiation is whether the fix resolves transitive chains or only direct dependencies, and whether the PR is merge-safe without manual review.

Traverses the full dependency graph to surface CVEs in indirect dependencies, packages required by your direct dependencies. Direct-only scanning misses the majority of vulnerable code paths in modern polyglot projects.

Identifies OSS licenses in the dependency tree and flags conflicts with the project's target license or policy (GPL contamination, copyleft obligations, export-controlled components). Separate from vulnerability detection.

Identifies packages with known-malicious behavior (typosquatting, dependency confusion, backdoored releases), distinct from packages with CVEs in legitimate code.

Scans images stored in registries (ECR, GCR, Artifact Registry, Docker Hub), for vulnerable OS packages and application dependencies at push time or on schedule, without requiring a running container.

Exports the dependency inventory as a machine-readable Software Bill of Materials in SPDX or CycloneDX format, consumable by downstream vulnerability scanners, compliance tools, and procurement workflows.

Scores open source dependency health using release cadence, maintainer count, contributor reputation, and popularity, flagging abandoned packages beyond known CVEs.

Blocks or flags PRs in CI/CD pipelines based on policy-defined thresholds, configurable by severity, CVSS score, exploitability, fix availability, or CVE age. Prevents vulnerable code from merging without requiring zero-tolerance policies.

Imports and exports SBOMs in CycloneDX, SPDX, and SWID formats, enabling interoperability with scan tools, procurement workflows, and regulatory evidence systems.

Monitors SBOMs against live vulnerability feeds, alerts when new CVEs affect components in managed SBOMs. Latency to alert after new CVE publication varies.

Creates, imports, and manages Vulnerability Exploitability eXchange statements asserting the exploitability status of CVEs for specific product versions, reducing false positive noise for downstream consumers.

Tracks license obligations across the SBOM inventory, identifying GPL and AGPL copyleft propagation, license conflicts, and FOSS obligations for each release.

Generates formatted evidence packages for SBOM-related regulatory requirements: FDA pre-market cybersecurity guidance, Executive Order 14028 SBOM requirements, EU Cyber Resilience Act Article 13.

Generates SBOMs from source code analysis (via build system integration), and from binary analysis (via binary composition analysis), the latter enabling SBOM generation for third-party software where source is unavailable.

Manages the SBOM life cycle including discovery, access and secure exchange between software suppliers and consumers.

Governs third-party software consumption to apply consistent software supply chain security policy.

Risk context for open-source dependencies including reachability, exploitability, and upgrade impact.

Deep analysis of binaries and packages to detect tampering, malware, and hidden threats beyond manifest-based scanning.

Detection and provenance tracking of AI and ML components, models, and LLM usage within the software supply chain.

Live visibility into code, components, pipelines, and developer activity across the software development lifecycle.

Compiles vendor, third-party and open-source maintainer reputation to flag risk from unmaintained, deprecated or abandoned software.