Supply Chain Security_ The Role of SBOMs and VEX in Cyber Risk Mitigation.pdf

The increasing complexity of software supply chains has made them a growing target for cyberattacks,particularly through third-party vendors. Traditional security measures often fail to detect these indirectattacks, which can remain hidden for extended periods and cause significant damage. This paper evaluatesthe role of Software Bills of Materials (SBOMs) and Vulnerability Exploitability eXchange (VEX)documents in improving transparency, accountability, and vulnerability management within softwaresystems. Through detailed case studies, including Target, Google’s Gerrit (GerriScary), UPMC, Wabtec,and Allegheny Health Network, the report highlights recurring patterns of supply chain weaknesses anddemonstrates how SBOM and VEX adoption could have mitigated the impact of these breaches. Inaddition to technical analysis, the paper discusses current policy frameworks, regulatory efforts such asExecutive Order 14028, and the limitations posed by outdated practices. To address these challenges, thereport proposes an innovative AI-powered platform that automatically generates SBOM and VEXdocuments, enhancing response times and accuracy.. This solution aims to streamline softwarevulnerability analysis and use a proactive security strategy. The findings emphasize the urgent need forstandardized adoption of SBOMs and VEX across sectors to secure the modern digital world.