SBOM Management Platform
Treats the SBOM as a starting point — verifiable digital supply-chain passports that surface the components a vendor's bill of materials never declared.
What it is
This platform treats the SBOM as a claim to be verified. It crosswalks a vendor's declared bill of materials against what is actually present in the shipped artifact, surfaces the delta, and replaces the flat SBOM line with a digital supply-chain passport: provenance, cryptographic chain of custody, lifecycle state, VEX status, and cross-regime regulatory recognition — travelling with the component and independently verifiable.
The gap it closes
An SBOM tells you what a vendor declared. The shipped artifact often tells a different story. In a safety-critical supply chain a single undeclared dependency inside firmware can be the entire incident — invisible to conventional SBOM ingestion because it was never on the list.
The platform makes the undeclared component visible and holds every declared one accountable to evidence.
How it works
Binary differential analysis against the vendor SBOM and a CycloneDX firmware manifest; a structured crosswalk that ranks declared-versus-detected deltas by risk; a passport schema carrying provenance, attestation, cryptographic lineage, VEX, and lifecycle; and a mapping from each passport to the regulatory frameworks an operator actually answers to.
What Sanctum delivered
A working reference platform and operating model — built end to end on the Parallax engine and self-hosted on infrastructure we control. Exercised live with nuclear regulators, operators, and research labs across seven countries. The model is engagement-ready.