ReversingLabs Spectra Assure

Exports the dependency inventory as a machine-readable Software Bill of Materials in SPDX or CycloneDX format, consumable by downstream vulnerability scanners, compliance tools, and procurement workflows.

Blocks or flags PRs in CI/CD pipelines based on policy-defined thresholds, configurable by severity, CVSS score, exploitability, fix availability, or CVE age. Prevents vulnerable code from merging without requiring zero-tolerance policies.

Defines open source policies (banned licenses, blocked packages, version floors, severity gates) as version-controlled rules applied automatically at scan time across repositories.

Traverses the full dependency graph to surface CVEs in indirect dependencies, packages required by your direct dependencies. Direct-only scanning misses the majority of vulnerable code paths in modern polyglot projects.

Identifies packages with known-malicious behavior (typosquatting, dependency confusion, backdoored releases), distinct from packages with CVEs in legitimate code.

Identifies OSS licenses in the dependency tree and flags conflicts with the project's target license or policy (GPL contamination, copyleft obligations, export-controlled components). Separate from vulnerability detection.

Prioritizes dependency vulnerabilities using exploitation signals such as EPSS probability and the CISA Known Exploited Vulnerabilities catalog, ranking findings by real-world exploitation likelihood rather than CVSS severity alone.

Identifies open source and third-party components in compiled binaries and closed-source artifacts where no package manifest exists.

Scores open source dependency health using release cadence, maintainer count, contributor reputation, and popularity, flagging abandoned packages beyond known CVEs.

Imports or generates Vulnerability Exploitability eXchange documents asserting whether a known CVE actually affects a given product in its deployed context, including statements derived from reachability analysis so an SBOM ships with evidence-backed exploitability. Reduces false positives in downstream consumers of SBOMs.

Detects code tampering and verifies build reproducibility by comparing released binaries against expected build behavior, surfacing supply chain compromises introduced between source and release.

Validates vendor-supplied SBOM declarations against the actual contents of compiled binaries, detecting missing, misdeclared, or tampered components before third-party software enters the environment.

Identifies malicious code patterns, backdoors, and trojanized components in binary artifacts using static signatures and ML classification.

Maps binary components to known CVEs using binary similarity analysis and function-level matching, relevant for third-party software lacking SBOMs.

Decompiles and analyzes compiled binaries for vulnerable code patterns, unsafe function calls, and embedded secrets, without requiring source code access.

Extracts, decompresses, and analyzes embedded firmware from IoT and OT devices, identifying CVEs in bundled libraries, hardcoded credentials, and unsafe configurations.

On-demand generation of software, firmware, and hardware bills of materials (SBOM, FBOM, HBOM) for endpoints, servers, and network devices, extending component inventory below the application layer.

Verification of build integrity and artifact provenance through signing, attestation, and change attribution.

Risk context for open-source dependencies including reachability, exploitability, and upgrade impact.

Deep analysis of binaries and packages to detect tampering, malware, and hidden threats beyond manifest-based scanning.

Governs third-party software consumption to apply consistent software supply chain security policy.

Detection and provenance tracking of AI and ML components, models, and LLM usage within the software supply chain.

Detection of exposed secrets and credentials in build artifacts and software packages, with prioritized remediation that distinguishes active credentials from stale ones.