VEX

Enrich your SBOMs and AIBOMs with precise exploitability indications powered by Raven. SBOMs and AIBOMs by themselves are records of the hundreds of open source libraries which build up an application. VEX or Vulnerability Exploitability eXchange plays a crucial role in enhancing the usefulness of SBOMs by providing context around known vulnerabilities. While SBOMs and AIBOMs list all components in a software product, they don't indicate whether a listed vulnerability actually affects the software. VEX fills this gap by specifying whether a given vulnerability is exploitable or not in the context of a specific product helping you prioritize risk, and avoid unnecessary patching by making informed decisions about their security posture.

Raven adds VEX to its SBOMs and AIBOMs based on its function level runtime reachability. While we may be listing hundreds of libraries containing vulnerabilities in the BOM for an application, usually only a couple of them are actually vulnerable. Raven determines the execution of libraries with vulnerabilities and within them, the execution of the specific functions which makes them vulnerable, all in real time, to calculate a VEX record per vulnerable library in your application.