AI Bill of Materials (A-BOM)¶

The A-BOM is CyberArmor's tenant-scoped inventory of software components observed across endpoints, repositories, and cloud sources, with vulnerability matching layered on top.

What it does¶

rolls up component observations (name, version, purl, cpe, hashes) into one row per logical component per tenant
records an append-only observation history so a rollup can be replayed if logic changes
matches components to vulnerabilities using OSV (which aggregates GHSA, PyPA, RustSec, and others)
enriches each advisory with CISA KEV (known-exploited) and FIRST EPSS (exploit-prediction) signals

Vulnerability prioritization¶

Findings are scored so remediation targets what matters:

CISA KEV — flags vulnerabilities with confirmed in-the-wild exploitation and due dates
FIRST EPSS — a probability score for near-term exploitation
CVSS — base severity

This same data drives remediation ordering in Patch Management.

Reading the A-BOM¶

Endpoint	Purpose
`GET /customer/abom/components`	tenant component inventory
`GET /customer/abom/vulnerabilities`	open findings grouped by advisory, with blast radius
`GET /customer/abom/components/{id}/vulnerabilities`	findings for one component
`POST /customer/abom/vuln-scan`	run a scan over the current inventory

Validation checklist¶

an enrolled endpoint's software surfaces under GET /customer/abom/components
POST /customer/abom/vuln-scan populates findings with CVE IDs
GET /customer/abom/vulnerabilities?only_kev=true returns known-exploited findings first