> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# SBOM and VEX (BM)

- URL: /taxonomies/software-factory/sbom-and-vex/
- Published: 2026-10-31T13:00:00.000Z
- Updated: 2026-10-29T12:59:02.853Z
- Description: SBOM and VEX (BM): 13 threats in the software factory threat taxonomy. SBOM generation, storage and exchange, VEX statements, decisions driven by inventory.
- Author: Brett Crawley

[Taxonomies](/taxonomies/) › [Software factory](/taxonomies/software-factory/) › SBOM and VEX

**Station 12 of 17 · Line 2, Artifact to Runtime · 13 threats · prefix BM**

An SBOM is a claim about an artifact, and every decision built on it inherits its gaps and its author's honesty. These cards cover SBOM generation, storage and exchange, VEX statements, and the vulnerability and licence decisions driven by inventory.

**Scope:** SBOM generation, storage and exchange, VEX statements, decisions driven by inventory.

![Table: SBOM and VEX (BM), 13 threats with their mitigation principles and design measures. The full text is in the PDF and Excel downloads on the software factory taxonomy overview page.](https://www.ostering.com/media/posts/115/taxonomy-table-12-BM.png =1400x4781)

*Text version: every entry on this page is in the [PDF and Excel downloads](/taxonomies/software-factory/) on the overview page, where it can be searched and copied.*

## The threats

- <span id="bm-a"></span>**BM·A** Unverifiable SBOM
- <span id="bm-k"></span>**BM·K** Incomplete Inventory
- <span id="bm-q"></span>**BM·Q** Malicious VEX
- <span id="bm-j"></span>**BM·J** SBOM Drift
- <span id="bm-10"></span>**BM·10** Identifier Ambiguity
- <span id="bm-9"></span>**BM·9** Hostile SBOM Document
- <span id="bm-8"></span>**BM·8** Inventory as Reconnaissance
- <span id="bm-7"></span>**BM·7** SBOM Store Tampering
- <span id="bm-6"></span>**BM·6** Stale VEX
- <span id="bm-5"></span>**BM·5** Conversion Loss
- <span id="bm-4"></span>**BM·4** Flat Inventory
- <span id="bm-3"></span>**BM·3** Compliance Theatre
- <span id="bm-2"></span>**BM·2** Missing Supplier SBOM

## Where this station touches others

- **Provenance and Attestation and SBOM and VEX:** provenance says how an artifact was made; the SBOM says what is in it. A verifier needs both to be true and both to describe the same artifact.

## Seen in the wild

No entry at this station names a public incident yet. That is not a sign that the station is safe; it is a sign that nobody has written the incident up.

## STRIDE, CAPEC and CWE

Of the 13 entries here, STRIDE fits 5 cleanly and 8 only loosely. CAPEC 3.9 has a pattern that describes 1 of them directly, only a generic parent pattern for 4, and nothing for 8. CWE 4.20 names the weakness directly for 7, has only a broader weakness for 5, and nothing for 1. The table below gives the mapping entry by entry, with the names of the CAPEC patterns and CWE weaknesses; what the mapping shows across the whole taxonomy is in [Mapping the Software Factory Threat Taxonomy to STRIDE, CAPEC and CWE](/mapping-the-software-factory-threat-taxonomy/). The Excel, SKOS and STIX downloads carry the same mapping as text.

![Table: STRIDE, CAPEC and CWE mapping for SBOM and VEX (BM), 13 threats, with each entry's STRIDE categories and fit, CAPEC 3.9 patterns and CWE 4.20 weaknesses. The full mapping is in the Excel, SKOS and STIX downloads on the software factory taxonomy overview page.](https://www.ostering.com/media/posts/115/software-factory-mapping-table-12-BM.png =1400x2009)

---

← [Firewall and Quarantine (FW)](/taxonomies/software-factory/firewall-and-quarantine/) · [Software factory overview](/taxonomies/software-factory/) · [Infrastructure as Code (IC)](/taxonomies/software-factory/infrastructure-as-code/) →

*© 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the licence on the [software factory overview](/taxonomies/software-factory/).*