SBOM for a gate operator (3D)
About this app
A gate operator as a software bill of materials in 3D: dependency tree with direct and transitive libraries, five releases and 58 customer installations. A headline reports a vulnerability and the 24-hour clock starts. Without an SBOM every customer counts as affected, with an SBOM five installations light up.
With explain mode: an AI tutor walks you through the app, points out what matters in the scene and answers your questions.
What an SBOM is
A software bill of materials lists every software component of a release: name, version, licence, package identifier (PURL), checksum and supplier, plus what each component depends on. Level 0 is the release, level 1 the directly built-in parts, level 2 the libraries inside them. The Cyber Resilience Act requires a machine-readable SBOM covering at least the top level as part of the technical documentation, mandatory from 11 Dec 2027. Since 11 Sep 2026, actively exploited vulnerabilities must be reported as an early warning within 24 hours.
What the app shows
A fictitious gate operator with control firmware, a supplier's radio module, an app and a cloud service, with ten open-source libraries below. Five releases run at 58 customer installations in logistics centres, airports, cold stores and ports, often under another brand. A headline reports a vulnerability in a transitive library. Without an SBOM all installations count as affected after 24 hours. With an SBOM, matching PURL and version hits 11 installations, and the assessment leaves 5.
Try it yourself
Trigger the headline and compare without and with an SBOM: the question chain (which library, which version, which customer, fix included, delivered) runs and the clock shows the time since awareness. Go through triage in three steps and see the three answers to customers. Click a component for its PURL and a CycloneDX excerpt, or an installation for brand and release.
Frequently asked questions
- What is a transitive dependency?
- A library that is not directly in your own product but sits inside a built-in component, such as a supplier's radio module. Many vulnerabilities, including Log4Shell, mainly affected such indirectly included libraries.
- What is a PURL?
- The package URL is a uniform package identifier following the pattern pkg:type/namespace/name@version. It lets SBOM components be matched automatically against vulnerability databases such as NVD, EUVD or OSV.
- What does the CRA require for the SBOM?
- Manufacturers create a machine-readable SBOM covering at least the top-level dependencies. It is part of the technical documentation and is provided to market surveillance on request; the obligation applies from 11 Dec 2027.
- What can I try in the app?
- Trigger a headline, switch between without and with an SBOM, play through the question chain and the triage steps check, assess, fix, change releases and view components with their PURL and a CycloneDX excerpt.
Subject: Betriebliche Weiterbildung
More from Betriebliche Weiterbildung
- CRA reporting deadlines: the reporting clock
- CRA quick check
- Cyber Resilience Act: applicability check
A VisuApp by heyprof: interactive, free in your browser, no sign-up. What is a VisuApp? · All apps