product-sbom-vex is a tool that helps you work with software bill of materials (SBOMs). It lets you bring your own build SBOMs and turns them into a product-level SBOM. It also creates Vulnerability Exploitability eXchange (VEX) documents based on the CSAF 2.0 standard. This helps companies meet the EU Cyber Resilience Act (CRA) compliance rules.
You don’t need to understand complex cybersecurity terms or software development to use it. The tool does the heavy lifting.
This tool is made for anyone who needs to organize and check software component data easily. It is a good fit if you:
- Manage software compliance.
- Work in security or IT teams.
- Need to gather and share clear SBOMs.
- Want to track vulnerabilities without manual work.
You only need basic computer skills. This guide walks you through every step on Windows.
Before you start, make sure your computer has:
- Windows 10 or later (64-bit).
- At least 4 GB of free disk space.
- A stable internet connection (needed to download the tool and updates).
- Administrator privileges to install software.
- Microsoft .NET Framework 4.8 or later.
- At least 8 GB of RAM recommended for larger SBOM files.
To get the tool, you must visit the official releases page.
Click this link to open the page where all the versions are listed.
On the releases page:
- Look for the latest release. It is usually at the top.
- The release will have files to download. The main file will be named something like
product-sbom-vex-setup.exeorproduct-sbom-vex-win.exe. - Click on the file link to download it.
Once the file finishes downloading:
- Open your “Downloads” folder.
- Double-click the installer file.
- If Windows asks for permission, click “Yes” or “Allow”.
The installer will guide you through:
- Selecting an install location (you can leave it at the default).
- Agreeing to terms and conditions.
- Clicking “Install” to begin.
The install process takes a few minutes.
After installation:
- You can open product-sbom-vex from your desktop shortcut or start menu.
- The first time you open it, the app may take a moment to load all necessary components.
- In the app, click the “Import SBOM” button.
- Navigate to the SBOM file on your computer.
- Select the SBOM file and click “Open”.
Supported SBOM formats include SPDX, CycloneDX, and simple JSON lists.
After importing:
- Click on “Generate Product SBOM”.
- The app will combine your build SBOMs into a clear summary document.
- You can save this file as JSON or XML.
To produce a Vulnerability Exploitability eXchange report:
- Click “Generate VEX”.
- The app analyzes your components for known vulnerabilities.
- It creates a report showing what risks apply to your product.
- Save or export this report for your compliance records.
You can export reports in formats your team or auditors understand. Export options include:
- JSON and XML files.
- Human-readable PDF files.
- Direct upload to compliance dashboards if integrated.
- If the installer doesn’t run, check your antivirus or Windows Defender settings and allow the program.
- Make sure you downloaded the Windows version, not a different OS installer.
- If the program crashes, restart your computer and try again.
- Use the “Help” menu inside the app for step-by-step guides.
- For support, check the Issues tab on GitHub or the community forums.
Check the releases page regularly to get updates:
When a new version is available:
- Download the new installer.
- Run it like before. It will replace the older version safely.
- Your previous settings and files will remain.
- CSAF 2.0 official documentation: Understand the standard product-sbom-vex uses for VEX creation.
- EU CRA guidelines: More about what compliance means and why SBOM and VEX are important.
- SBOM formats overview: Learn the difference between SPDX, CycloneDX, and others.
product-sbom-vex automates tasks usually done by experts. It reads your build SBOM files. Then, it unites all software components into a product-level list that fits EU compliance rules. It creates VEX reports that show risk levels of vulnerabilities per product. This helps you track security issues without manual effort.
The tool processes your SBOM data locally, without sending it to external servers by default. Your data stays on your computer. You can export files and share them securely with your partners or auditors.
You control your data and how it is used.
Q: Do I need to know programming to use this?
A: No. The app is designed for users with basic computer skills.
Q: Can I use this on Mac or Linux?
A: This app currently supports only Windows.
Q: What if my SBOM format is not supported?
A: Check the list of compatible formats. You may convert your file using free online tools before import.
Q: How does product-sbom-vex help with compliance?
A: It organizes and standardizes your SBOM and vulnerability info in formats that regulators require.
Q: Can I use this tool offline?
A: Yes, you can work offline after downloading and installing the app.