Plexicus XBOM unifies SBOM, CBOM and AIBOM into a single source of truth — with VEX statements, watchlists, drift detection and standards-ready exports (CycloneDX, SPDX, PDF). Built for the EU CRA, CISA 2025, PCI DSS 6.3.2 and the EU AI Act.
SBOM, CBOM and AIBOM each answer a different audit question. Plexicus stitches them together so the same component, key or model has one identity across every view.
Libraries, packages and dependencies across every repository — with license category, VEX status and provenance attached.
Algorithms, key sizes, primitives and context — with quantum-readiness scoring against the NIST 2030/2035 deadlines.
Models, datasets, providers and risk flags — including serialisation risk, restricted licences and missing model cards.
Switch inventory views to review components, cryptographic assets, and AI model dependencies.
Synthetic demo data
| Component | Version | Repository | License | Vulnerabilities |
|---|---|---|---|---|
| lodash | 4.17.21 | sample-project/checkout | MIT | high CVE-2021-23337 |
| log4j-core | 2.14.1 | sample-project/payments | Apache-2.0 | critical CVE-2021-44228 |
| @types/node | 20.11.30 | sample-project/api | MIT | clean |
| requests | 2.31.0 | sample-project/scanner | Apache-2.0 | low CVE-2023-32681 |
| Algorithm | Key size / Params | Repository | Quantum classification |
|---|---|---|---|
| RSA-2048 | 2048-bit | sample-project/identity | quantum-vulnerable |
| AES-256-GCM | 256-bit | sample-project/payments | quantum-safe |
| ECDSA-P256 | 256-bit · NIST P-256 | sample-project/tokens | quantum-vulnerable |
| ChaCha20-Poly1305 | 256-bit | sample-project/api | quantum-safe |
| Model | Provider | Repository | Risk flags |
|---|---|---|---|
| gpt-4o-mini | OpenAI | sample-project/copilot | External API |
| claude-3.5-sonnet | Anthropic | sample-project/triage | External API No model card |
| all-MiniLM-L6-v2 | self-hosted (HuggingFace) | sample-project/search | Unsafe serialisation |
| whisper-large-v3 | self-hosted (HuggingFace) | sample-project/voice | Restricted licence |
Pick the profile your auditor needs. Plexicus prepares a clear document with status, evidence, and provenance.
SBOM + vulnerability handling per Annex I §2. Mandatory for products with digital elements from 2027.
SBOM + VEX + data fields per CISA's minimum elements for vulnerability management.
Inventory of software components and cryptographic assets for payment systems.
AIBOM with model cards, dataset provenance and risk classification per Article 13.
A BOM is useful when each component carries a clear status, reason, and next action for the reviewer.
One statement per CVE per component — not a single global 'all clear' that no auditor trusts.
Each status includes the supporting evidence and reason a reviewer can inspect.
Exports both formats with the VEX section embedded. Drop straight into a Dependency-Track or GUAC instance.
Import a supplier SBOM + VEX in one upload. Plexicus reconciles PURLs and surfaces the components you actually own.
Watch any name, PURL or CVE. Plexicus scans new findings against your watchlist on every cycle and notifies you the moment one matches.
Plexicus compares every scan against the previous one for the same repository — added, removed and changed components, surfaced in seconds. VEX is preserved across the diff.
+ log4j-core 2.14.1 (new dependency) New dependency added since last scan.
− requests 2.28.0 (upgraded) Out of inventory after upgrade.
~ axios 0.27.2 → 1.6.2 (VEX: not_affected → fixed) VEX status updated alongside version bump.
CycloneDX, SPDX, PDF attestation, machine-readable VEX. Push to your GRC, your artefact store, your Dependency-Track. Pull from suppliers.
Full BOM + VEX in a single document. Drop into Dependency-Track, GUAC, or any SBOM-aware tool.
SPDX-native export for legal and compliance teams. PURLs, licences and hashes preserved.
Sign-ready PDF profile for EU CRA BSI TR-03183-2, CISA 2025, PCI DSS 6.3.2 and EU AI Act.
Push BOMs to Drata, Vanta and Tugboat. Create tickets in your tracker from a watchlist match.
Book a 30-minute walkthrough. We'll import a real CycloneDX SBOM, attach a VEX statement, run the CRA profile and hand you the PDF.
