pith. sign in

arxiv: 2606.19390 · v1 · pith:L7ZLZOQEnew · submitted 2026-06-16 · 💻 cs.SE · cs.AI

Execution-bound advisory automation for agentic AI: a reproducible AIBOM-driven CSAF-VEX framework

Petar Radanliev , Omar Santos , Carsten Maple , Kay Atefi This is my paper

Pith reviewed 2026-06-26 23:43 UTC · model grok-4.3

classification 💻 cs.SE cs.AI
keywords SBOMAIBOMCSAF-VEXagentic AIexploitabilityruntime telemetrysecurity advisoriesreproducible framework
0
0 comments X

The pith

A protocol-driven framework binds SBOM and AIBOM to deterministic runtime telemetry to compute exploitability and generate signed CSAF-VEX advisories for agentic AI.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper presents a framework that links software and AI bill-of-materials records to captured execution environments and runtime observations. Exploitability is derived from the combination of declared components, activation conditions, and enforced policies, which then feeds into automatically produced, cryptographically signed CSAF-VEX documents. These documents are checked for consistency through deterministic replay. The approach is demonstrated on roughly 10,000 component entries drawn from synthetic agentic AI workloads ranging from 50 to 5,000 components and standard vulnerability datasets. A sympathetic reader would care because it offers a reproducible path from static and dynamic evidence to machine-readable security advisories without relying solely on manual analysis.

Core claim

A protocol-driven framework binds SBOM and AIBOM artefacts to deterministic environment capture and structured runtime telemetry. Exploitability is computed from declared artefacts, observed activation conditions, and enforced execution policies. CSAF VEX advisories are generated from the combined static and runtime evidence, cryptographically signed, and validated through deterministic replay.

What carries the argument

The AIBOM-driven CSAF-VEX protocol that links declared artefacts and runtime telemetry to signed advisory generation.

If this is right

  • Advisories can be produced automatically from the combination of static artefacts and observed runtime conditions rather than static analysis alone.
  • Cryptographic signing and deterministic replay make the generated CSAF-VEX documents reproducible across independent verifiers.
  • Evaluation across workloads of 50 to 5000 components shows the framework scales to moderate-sized synthetic agentic systems while incorporating OSV, GitHub Advisory, KEV, and EPSS data.
  • Exploitability calculations incorporate enforced execution policies, allowing policy changes to affect advisory output directly.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the synthetic workloads generalize, the same binding of artefacts to telemetry could support continuous advisory updates in deployed production agentic systems.
  • The approach might reduce reliance on manual triage by surfacing only those vulnerabilities that match observed activation conditions.
  • Integration with existing SBOM tooling could allow the framework to be inserted into existing CI/CD pipelines for AI components without new data formats.

Load-bearing premise

Synthetic agentic AI workloads of 50 to 5000 components plus public vulnerability datasets accurately represent real-world execution conditions, and static plus runtime evidence can reliably compute exploitability without significant false positives or negatives.

What would settle it

Deploy the framework on a live agentic AI system containing a known exploitable component under controlled conditions and check whether the generated VEX advisory correctly flags or clears the component compared with observed exploit success.

read the original abstract

A protocol driven framework is presented that binds SBOM and AIBOM artefacts to deterministic environment capture and structured runtime telemetry. Exploitability is computed from declared artefacts, observed activation conditions, and enforced execution policies. CSAF VEX advisories are generated from combined static and runtime evidence, cryptographically signed, and validated through deterministic replay. Evaluation uses approximately 10000 component entries across synthetic Agentic AI workloads 50 to 5000 components, incorporating OSV, GitHub Advisory, KEV, and EPSS datasets.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 0 minor

Summary. The manuscript presents a protocol-driven framework that binds SBOM and AIBOM artefacts to deterministic environment capture and structured runtime telemetry. Exploitability is computed from declared artefacts, observed activation conditions, and enforced execution policies. CSAF-VEX advisories are generated from the combined static and runtime evidence, cryptographically signed, and validated through deterministic replay. The evaluation uses approximately 10000 component entries drawn from synthetic Agentic AI workloads of 50 to 5000 components, incorporating OSV, GitHub Advisory, KEV, and EPSS datasets.

Significance. If the framework's claims hold, it would provide a reproducible, evidence-based method for generating execution-bound security advisories tailored to agentic AI systems, potentially improving vulnerability management by linking static declarations with runtime observations and adding cryptographic verifiability. The deterministic replay validation is a notable strength for reproducibility. However, the significance is constrained by the exclusive use of synthetic workloads, which leaves open whether the exploitability signals generalize to real-world conditions.

major comments (2)
  1. [Evaluation description] Evaluation description (abstract and evaluation section): The manuscript states that the evaluation uses approximately 10000 component entries but provides no details on computation methods for exploitability, specific results, error handling, or validation outcomes. This absence makes it impossible to assess whether the static-plus-runtime evidence combination supports the central claim of reliable exploitability computation from artefacts, activation conditions, and policies.
  2. [Evaluation description] Evaluation description (abstract and evaluation section): The framework is tested exclusively on synthetic Agentic AI workloads (50-5000 components) plus public vulnerability datasets, yet no analysis is given of how these map to real-world activation conditions or of the resulting false-positive/negative rates for exploitability. This is load-bearing for the claim that the approach yields reliable advisories beyond the synthetic regime.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive comments regarding the evaluation description. We address each major comment below.

read point-by-point responses

  1. Referee: [Evaluation description] Evaluation description (abstract and evaluation section): The manuscript states that the evaluation uses approximately 10000 component entries but provides no details on computation methods for exploitability, specific results, error handling, or validation outcomes. This absence makes it impossible to assess whether the static-plus-runtime evidence combination supports the central claim of reliable exploitability computation from artefacts, activation conditions, and policies.

    Authors: We agree that the evaluation section lacks these details. In the revised manuscript we will expand the evaluation section to include the exploitability computation methods (including algorithms and formulas), specific quantitative results and metrics from the ~10000 entries, error handling procedures, and validation outcomes from deterministic replay. revision: yes

  2. Referee: [Evaluation description] Evaluation description (abstract and evaluation section): The framework is tested exclusively on synthetic Agentic AI workloads (50-5000 components) plus public vulnerability datasets, yet no analysis is given of how these map to real-world activation conditions or of the resulting false-positive/negative rates for exploitability. This is load-bearing for the claim that the approach yields reliable advisories beyond the synthetic regime.

    Authors: The evaluation deliberately uses synthetic workloads to support deterministic replay and controlled experimentation. We will add a limitations subsection that discusses the design of the synthetic workloads, their intended approximation to real-world agentic AI activation conditions, and a qualitative assessment of possible false-positive/negative implications. Quantitative false-positive/negative rates from real-world deployments are not available in the current study. revision: partial

Circularity Check

0 steps flagged

No circularity in derivation chain

full rationale

The manuscript describes a framework that binds SBOM/AIBOM artefacts to runtime telemetry for computing exploitability and generating signed CSAF-VEX advisories, with evaluation on synthetic workloads of 50-5000 components plus public vulnerability datasets. No equations, derivations, fitted parameters presented as predictions, or load-bearing self-citations appear in the provided text. The central claims rest on the protocol design and external datasets rather than any self-referential reduction of outputs to inputs by construction, satisfying the default expectation of no significant circularity.

Axiom & Free-Parameter Ledger

0 free parameters · 0 axioms · 0 invented entities

Abstract provides no information on free parameters, axioms, or invented entities; all arrays are empty due to lack of technical details.

pith-pipeline@v0.9.1-grok · 5620 in / 1220 out tokens · 43432 ms · 2026-06-26T23:43:29.957012+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

100 extracted references · 17 canonical work pages

  1. [1]

    # Pseudocode for Secure and Reproducible CSAF-VEX Assertion Generation 2

  2. [2]

    function initiate_advisory_pipeline(container_image, input_data, execution_policy):

  3. [3]

    # STAGE 1: Environment Initialisation and MCP Context Capture

  4. [4]

    mcp_metadata = MCP.capture_pre_execution_state(

  5. [5]

    Petar Radanliev Parks Road, Oxford OX1 3PJ United Kingdom Email: petar.radanliev@cs.ox.ac.uk BA Hons., MSc., Ph.D

    ) Dr. Petar Radanliev Parks Road, Oxford OX1 3PJ United Kingdom Email: petar.radanliev@cs.ox.ac.uk BA Hons., MSc., Ph.D. Post-Doctorate 33

  6. [6]

    mcp_hash = Crypto.sign_and_seal(mcp_metadata) 11

  7. [7]

    # STAGE 2: Runtime Telemetry via Agent2Agent Protocol

  8. [8]

    runtime_agent = A2A.spawn_agent(

  9. [9]

    telemetry_stream = A2A.collect_runtime_telemetry(runtime_agent) 19

  10. [10]

    # STAGE 3: Exploitability Inference

  11. [11]

    sbom_data = SBOM.extract(mcp_metadata)

  12. [12]

    matched_cves = VulnerabilityScanner.match_cves(sbom_data)

  13. [13]

    exploitability_report = InferenceEngine.assess_exploitability(

  14. [14]

    # STAGE 4: CSAF-VEX Assertion Generation

  15. [15]

    vex_document = CSAF.build_vex_assertions(

  16. [16]

    exploitability_report,

  17. [17]

    runtime_agent.identity

  18. [18]

    signed_vex = Crypto.sign_vex(vex_document) 37

  19. [19]

    # STAGE 5: Advisory Validation via AGNTCY Orchestration

  20. [20]

    if AGNTCY.validate_agent(runtime_agent.identity) and AGNTCY.validate_vex(signed_vex):

  21. [21]

    AGNTCY.register_advisory(signed_vex)

  22. [22]

    VEX validation failed or agent unauthorised

    raise SecurityException("VEX validation failed or agent unauthorised") 43

  23. [23]

    # STAGE 6: Reproducibility Testing and Audit Verification

  24. [24]

    audit_environment = clone_environment(mcp_metadata)

  25. [25]

    audit_output = replay_advisory_pipeline(...)

  26. [26]

    audit_environment.image,

  27. [27]

    audit_environment.input_data,

  28. [28]

    audit_environment.policy

  29. [29]

    if Hash.compare(signed_vex, audit_output.signed_vex):

  30. [30]

    TransparencyLayer.publish(signed_vex, metadata=mcp_metadata)

  31. [31]

    Audit hash mismatch: advisory not reproducible

    raise ReproducibilityException("Audit hash mismatch: advisory not reproducible") 55. This pseudocode operationalises the six-stage framework as follows:

  32. [32]

    Initialisation (MCP Capture): Captures system fingerprint, dependency graphs, security policy context, and cryptographically signs the metadata envelope

  33. [33]

    Runtime Coordination (A2A): Deploys secure agents for process-level observability and policy-scoped telemetry logging

  34. [34]

    Exploitability Inference: Matches observed components to known CVEs and evaluates their exploitability using runtime conditions and policy enforcement logs

  35. [35]

    CSAF-VEX Generation: Constructs formal vulnerability statements based on CSAF 2.0/VEX schema, integrating runtime evidence and MCP lineage. Dr. Petar Radanliev Parks Road, Oxford OX1 3PJ United Kingdom Email: petar.radanliev@cs.ox.ac.uk BA Hons., MSc., Ph.D. Post-Doctorate 34

  36. [36]

    Advisory Validation (AGNTCY): Validates advisory schema and signs artefacts through a decentralised trust authority, ensuring audit traceability

  37. [37]

    what is deployed

    Reproducibility Verification: Re-executes the containerised job under identical conditions, ensuring the advisory output is deterministically reproducible. Confirms this via hash comparison before publication in a federated graph- based transparency layer. The empirical evaluation directly measures the effect of extending static SBOM- based vulnerability ...

  38. [38]

    Lemay, Antoine., and Katiyar, Neeraj, ‘Supply Chain Risk Analysis Via SBOM Data Enrichment’, SysCon 2025 - 19th Annual IEEE International Systems Conference, Proceedings, 2025, doi: 10.1109/SYSCON64521.2025.11014830

    work page doi:10.1109/syscon64521.2025.11014830 2025

  39. [39]

    13–16, 2025, doi: 10.1109/ICSE-COMPANION66252.2025.00013

    Jia, Changguo., Li, Nianyu., Yang, Kai., and Zhou, Minghui, ‘SIT: An Accurate, Compliant SBOM Generator with Incremental Construction’, Proceedings - International Conference on Software Engineering, pp. 13–16, 2025, doi: 10.1109/ICSE-COMPANION66252.2025.00013. Dr. Petar Radanliev Parks Road, Oxford OX1 3PJ United Kingdom Email: petar.radanliev@cs.ox.ac.u...

    work page doi:10.1109/icse-companion66252.2025.00013 2025

  40. [40]

    ISO, 2025, URL: https://www.iso.org/standard/89986.html

    ISO, ISO/IEC 20153:2025 - Information technology — OASIS Common Security Advisory Framework (CSAF) v2.0 Specification. ISO, 2025, URL: https://www.iso.org/standard/89986.html

    2025

  41. [41]

    [Online]

    Springett, Steve, ‘Vulnerability and Exploitability Transparency - VDR & VEX | OWASP Foundation’, OWASP, Feb-2023. [Online]. Available: https://owasp.org/blog/2023/02/07/vdr-vex-comparison. [Accessed: 25-Apr- 2023], URL: https://owasp.org/blog/2023/02/07/vdr-vex-comparison

    2023

  42. [42]

    [Online]

    OWASP, ‘OWASP AIBOM | OWASP Foundation’, 2025. [Online]. Available: https://owasp.org/www-project-aibom/. [Accessed: 12-Jul-2025], URL: https://owasp.org/www-project-aibom/

    2025

  43. [43]

    Thomas Schmidt, ‘Vulnerability management with CSAF – why SBOM is not enough’, Frankfurt, 2022, URL: https://owasp.org/www-chapter- frankfurt/assets/slides/58_OWASP_Frankfurt_Stammtisch_1.pdf

    2022

  44. [44]

    [Online]

    OASIS, ‘Using CSAF to Respond to Supply Chain Vulnerabilities at Large Scale’, OASIS Open, 2022. [Online]. Available: https://us06web.zoom.us/webinar/register/WN_KqD-a1t5SpuMI7w9cI7ZDg. [Accessed: 03-Jan-2023], URL: https://us06web.zoom.us/webinar/register/WN_KqD-a1t5SpuMI7w9cI7ZDg

    2022

  45. [45]

    Schmidt, Leon., Hammer, Daniel., Biß, Klaus., and Schmidt, Thomas, ‘Media Faculty in cooperation with the Development of an API to request security advisories for CSAF 2.0 by Enterprise and IT Security Supervision’, 2022

    2022

  46. [46]

    TREvolution, ‘TREvolution - DARE UK’, 2025, URL: https://dareuk.org.uk/how- we-work/ongoing-activities/trevolution/

    2025

  47. [47]

    Li, Qiaomu., and Xie, Ying, ‘From Glue-Code to Protocols: A Critical Analysis of A2A and MCP Integration for Scalable Agent Systems’, May 2025, URL: https://arxiv.org/pdf/2505.03864

    arXiv 2025

  48. [48]

    Priv., vol

    Okhravi, Hamed., Burow, Nathan., and Schneider, Fred B., ‘Software Bill of Materials as a Proactive Defense’, IEEE Secur. Priv., vol. 23, no. 2, pp. 101– 106, 2025, doi: 10.1109/MSEC.2025.3528535

    work page doi:10.1109/msec.2025.3528535 2025

  49. [49]

    Azizi, Sara., Pakshad, Puya., Shameli-Sendi, Alireza., and Faraji Daneshgar, Fateme, ‘Vulnerability scoring metric of CVSS needs to be adjusted per each product: our analysis on Linux and Apache’, Information Security Journal, May 2025, doi: 10.1080/19393555.2025.2498466;JOURNAL:JOURNAL:UISS19;WGROUP:S TRING:PUBLICATION, URL: https://www.tandfonline.com/d...

    work page doi:10.1080/19393555.2025.2498466;journal:journal:uiss19;wgroup:s 2025

  50. [50]

    141–160, 2024, doi: 10.23919/CYCON62501.2024.10685598

    Beninger, Max., Charland, Philippe., Ding, Steven H.H., and Fung, Benjamin C.M., ‘ERS0: Enhancing Military Cybersecurity with AI-Driven SBOM for Firmware Vulnerability Detection and Asset Management’, International Conference on Cyber Conflict, CYCON, pp. 141–160, 2024, doi: 10.23919/CYCON62501.2024.10685598. Dr. Petar Radanliev Parks Road, Oxford OX1 3PJ...

    work page doi:10.23919/cycon62501.2024.10685598 2024

  51. [51]

    Liqian Lim, ‘The Essential Guide to AI Bills of Materials (AIBOMs)’, 2025, URL: https://snyk.io/articles/ai-security/ai-bill-of-materials-aibom/

    2025

  52. [52]

    [Online]

    Rao Surapaneni., Miku Jha., Michael Vakoc., and Todd Segal, ‘Announcing the Agent2Agent Protocol (A2A)’, Google Developers Blog, 2025. [Online]. Available: https://developers.googleblog.com/en/a2a-a-new-era-of-agent- interoperability/. [Accessed: 05-Jul-2025], URL: https://developers.googleblog.com/en/a2a-a-new-era-of-agent-interoperability/

    2025

  53. [53]

    [Online]

    AGNTCY, ‘AGNTCY.org’, An open source collective for inter-agent collaboration., 2025. [Online]. Available: https://agntcy.org/. [Accessed: 05-Jul- 2025], URL: https://agntcy.org/

    2025

  54. [54]

    [Online]

    VEX, ‘Vulnerability Exploitability eXchange (VEX) – Use Cases’, 2022. [Online]. Available: https://www.cisa.gov/sbom. [Accessed: 03-Jan-2023], URL: https://www.cisa.gov/sbom

    2022

  55. [55]

    Department of Homeland Security, Cybersecurity and Infrastructure Security Agency, 2023, URL: http://www.cisa.gov/tlp/

    CISA, ‘Minimum Requirements for Vulnerability Exploitability eXchange (VEX)’, U.S. Department of Homeland Security, Cybersecurity and Infrastructure Security Agency, 2023, URL: http://www.cisa.gov/tlp/

    2023

  56. [56]

    [Online]

    Kunorubwe, Peter., Martin, Alex, ‘Managing the risks and realising the opportunities of using third party Software Asset Management (SAM) providers’, Deloitte, 06-Jul-2018. [Online]. Available: https://www.deloitte.com/uk/en/services/audit-assurance/research/sam-blogs- and-bulletins.html. [Accessed: 07-May-2026], URL: https://www.deloitte.com/uk/en/servic...

    2018

  57. [57]

    [Online]

    Wiesner, Jens, ‘CSAF, Not SBOM, Is The Solution’, S4x22 - BSI, 2022. [Online]. Available: https://www.youtube.com/watch?v=fKlW9vOs7X4&t=504s. [Accessed: 03-Jan-2023], URL: https://www.youtube.com/watch?v=fKlW9vOs7X4&t=504s

    2022

  58. [58]

    [Online]

    NIST, ‘NVD - CVSS v3 Calculator’, CVSS Version 3.1, 2022. [Online]. Available: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator. [Accessed: 03- Jan-2023], URL: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator

    2022

  59. [59]

    [Online]

    Manion, Art, ‘SSVC: Stakeholder-Specific Vulnerability Categorization’, Carnegie Mellon University, 2020. [Online]. Available: https://bit.ly/3ambIP4. [Accessed: 02-Jan-2023], URL: https://bit.ly/3ambIP4

    2020

  60. [60]

    [Online]

    NIST, ‘Product Integration using NVD CVSS Calculators’, 2022. [Online]. Available: https://nvd.nist.gov/Vulnerability-Metrics/Calculator-Product- Integration. [Accessed: 09-Jan-2026], URL: https://nvd.nist.gov/Vulnerability- Metrics/Calculator-Product-Integration

    2022

  61. [61]

    Williams, Laurie., Benedetti, Giacomo., Hamer, Sivana., Paramitha, Ranindya., Rahman, Imranur., Tamanna, Mahzabin., Tystahl, Greg., … Enck, William, ‘Research Directions in Software Supply Chain Security’, ACM Transactions on Software Engineering and Methodology, vol. 34, no. 5, May 2025, doi: 10.1145/3714464, URL: /doi/pdf/10.1145/3714464?download=true. ...

    work page doi:10.1145/3714464 2025

  62. [62]

    Takahashi, Takeshi., and Kadobayashi, Youki, ‘Reference Ontology for Cybersecurity Operational Information’, Comput. J., vol. 58, no. 10, pp. 2297– 2312, Oct. 2015, doi: 10.1093/COMJNL/BXU101, URL: https://dx.doi.org/10.1093/comjnl/bxu101

    work page doi:10.1093/comjnl/bxu101 2015

  63. [63]

    2022, doi: 10.2172/1901825

    Eggers, Shannon Leigh., Christensen, Drew., Simon, Tori Brooke., Morgan, Baleigh Rae., and Bauer, Ethan S, ‘Towards Software Bill of Materials in the Nuclear Industry’, Sep. 2022, doi: 10.2172/1901825

    work page doi:10.2172/1901825 2022

  64. [64]

    2022, URL: https://uptane.org/papers/scudo-whitepaper.pdf

    Moore, Marina., Sirish, Aditya., Yelgundhalli, A., Kuppusamy, Trishank Karthik., Torres-Arias, Santiago., Delong, Lois Anne., and Cappos, Justin, ‘Scudo: A Proposal for Resolving Software Supply Chain Insecurities in Vehicles The second in a series of whitepapers on emerging and critical issues in automotive cybersecurity’, New York City, Jul. 2022, URL: ...

    2022

  65. [65]

    [Online]

    Jackson, Wayne, ‘Code, Cars, and Congress: A Time for Cyber Supply Chain Management (1 of 3)’, Sonatype, 2014. [Online]. Available: https://blog.sonatype.com/2014/12/cyber-supply-chain-management-part1/. [Accessed: 03-Jan-2023], URL: https://blog.sonatype.com/2014/12/cyber- supply-chain-management-part1/

    2014

  66. [66]

    [Online]

    NTIA, ‘SBOM at a Glance’, NTIA Multistakeholder Process on Software Component Transparency | ntia.gov/sbom, 2021. [Online]. Available: https://tiny.cc/SPDX. [Accessed: 03-Jan-2023], URL: https://tiny.cc/SPDX

    2021

  67. [67]

    [Online]

    Royce, Edward R., ‘H.R.5793 - 113th Congress (2013-2014): Cyber Supply Chain Management and Transparency Act of 2014’, Congress.Gov, 2014. [Online]. Available: http://www.congress.gov/. [Accessed: 03-Jan-2023], URL: http://www.congress.gov/

    2013

  68. [68]

    [Online]

    Howard, Matt, ‘Cybersecurity Improvement Act of 2017: The Ghost of Congress Past - DevOps.com’, devops.com, 2017. [Online]. Available: https://devops.com/cybersecurity-improvement-act-2017-ghost-congress-past/. [Accessed: 03-Jan-2023], URL: https://devops.com/cybersecurity- improvement-act-2017-ghost-congress-past/

    2017

  69. [69]

    [Online]

    Biden, Joseph, ‘Executive Order on Improving the Nation’s Cybersecurity | The White House’, The White House, 12-May-2021. [Online]. Available: https://www.whitehouse.gov/briefing-room/presidential- actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/. [Accessed: 03-Jan-2023], URL: https://www.whitehouse.gov/briefing- room/presidentia...

    2021

  70. [70]

    56–60, doi: 10.1145/3713081.3731738, URL: https://dl.acm.org/doi/pdf/10.1145/3713081.3731738

    Qiu, Tong., Zhu, Jiaxin., Chen, Wei., and Wei, Jun, ‘LiPSBOMaker: A Prototype of Multi-Stage Linux Distribution Package SBOM Generator’, 2025, pp. 56–60, doi: 10.1145/3713081.3731738, URL: https://dl.acm.org/doi/pdf/10.1145/3713081.3731738. Dr. Petar Radanliev Parks Road, Oxford OX1 3PJ United Kingdom Email: petar.radanliev@cs.ox.ac.uk BA Hons., MSc., Ph....

    work page doi:10.1145/3713081.3731738 2025

  71. [71]

    [Online]

    CISA, ‘Software Bill of Materials’, Cybersecurity & Infrastructure Security Agency, 2018. [Online]. Available: https://www.cisa.gov/sbom. [Accessed: 24- Dec-2022], URL: https://www.cisa.gov/sbom

    2018

  72. [72]

    Washington, D.C: The National Telecommunications and Information Administration (NTIA), 2021, URL: https://ntia.gov/page/software- bill-materials

    NTIA, National Telecommunications and Information Administration, Software Bill of Materials (SBOM) | National Telecommunications and Information Administration. Washington, D.C: The National Telecommunications and Information Administration (NTIA), 2021, URL: https://ntia.gov/page/software- bill-materials

    2021

  73. [73]

    Capability: A Comparative Analysis of the SBOM Generation Tools for Rust Projects’, Proceedings of the ACM Symposium on Applied Computing, pp

    Rabbi, Md Fazle., Champa, Arifa Islam., and Zibran, Minhaz Fahim, ‘Claim vs. Capability: A Comparative Analysis of the SBOM Generation Tools for Rust Projects’, Proceedings of the ACM Symposium on Applied Computing, pp. 1712–1720, May 2025, doi: 10.1145/3672608.3707940, URL: /doi/pdf/10.1145/3672608.3707940?download=true

    work page doi:10.1145/3672608.3707940 2025

  74. [74]

    IEEE/ACM 22nd Int

    Kishimoto, Rio., Kanda, Tetsuya., Manabe, Yuki., Inoue, Katsuro., Qiu, Shi., and Higo, Yoshiki, ‘A Dataset of Software Bill of Materials for Evaluating SBOM Consumption Tools’, in 2025 IEEE/ACM 22nd International Conference on Mining Software Repositories (MSR), 2025, pp. 576–580, doi: 10.1109/MSR66628.2025.00090

    work page doi:10.1109/msr66628.2025.00090 2025

  75. [75]

    [Online]

    SPDX, ‘Software Package Data Exchange (SPDX)’, International Open Standard (ISO/IEC 5962:2021) , 2023. [Online]. Available: https://spdx.dev/. [Accessed: 19-Apr-2023], URL: https://spdx.dev/

    2021

  76. [76]

    [Online]

    CycloneDX, ‘OWASP CycloneDX Software Bill of Materials (SBOM) Standard’, Full-stack Bill of Materials (BOM) standard, 2023. [Online]. Available: https://cyclonedx.org/. [Accessed: 19-Apr-2023], URL: https://cyclonedx.org/

    2023

  77. [77]

    [Online]

    SWID, ‘Software Identification (SWID) Tagging | CSRC | NIST’, National Institute of Standards and Technology. [Online]. Available: https://csrc.nist.gov/projects/Software-Identification-SWID. [Accessed: 19-Apr- 2023], URL: https://csrc.nist.gov/projects/Software-Identification-SWID

    2023

  78. [78]

    [Online]

    O’Driscoll, Aimee, ‘25+ Cyber Security Vulnerability Statistics and Facts of 2023’, Comparitech, 2022. [Online]. Available: https://www.comparitech.com/blog/information-security/cybersecurity- vulnerability-statistics/. [Accessed: 03-Jan-2023], URL: https://www.comparitech.com/blog/information-security/cybersecurity- vulnerability-statistics/

    2023

  79. [79]

    NTIA, the U.S. National Telecommunications and Information Administration, ‘Vulnerability-Exploitability eXchange (VEX)’, 2021, URL: https://ntia.gov/files/ntia/publications/vex_one-page_summary.pdf

    2021

  80. [80]

    [Online]

    OASIS, ‘OASIS Common Security Advisory Framework (CSAF) TC | OASIS’, OASIS OPEN, 2022. [Online]. Available: https://www.oasis- open.org/committees/tc_home.php?wg_abbrev=csaf. [Accessed: 03-Jan- 2023], URL: https://www.oasis- open.org/committees/tc_home.php?wg_abbrev=csaf. Dr. Petar Radanliev Parks Road, Oxford OX1 3PJ United Kingdom Email: petar.radanliev...

    2022

Showing first 80 references.