CetraLog ingests your SBOMs, finds the vulnerabilities that actually matter, and produces signed, regulator-ready evidence — continuously, without your code ever leaving your perimeter.
Compliance teams drown in raw CVE noise. CetraLog turns SBOMs into a prioritised, defensible security posture — and the paperwork to prove it.
Cross-reference every component against live exploit intelligence and your own VEX triage. Cut thousands of findings down to the handful you must act on.
Every action is signed into a tamper-evident ledger and exportable as a regulator-ready packet. Audit prep goes from weeks to one click.
Code is scanned and anonymised inside your perimeter — only sanitised metadata leaves. Suppliers and primes collaborate without exposing source.
One workspace covering the full supply-chain compliance lifecycle.
Parse CycloneDX 1.4–1.7 with full provenance, hashes, and cryptographic assets (CBOM). Validated against BSI TR-03183-2 on the way in.
Batch-query OSV.dev, GitHub Advisories, CISA KEV, and sovereign CERT feeds. De-duplicated and matched to your components by PURL.
Mark findings not-affected, fixed, or under investigation — justifications kept for audit. Exports as CSAF 2.0 VEX; ingests supplier CSAF advisories.
Track the 24-hour early-warning and 72-hour technical-impact windows automatically, with countdowns and EOL alerts per component.
Primes and sub-vendors stay fully isolated, sharing only signature-verified SBOM handshakes. Supplier IP is masked end to end.
Every compliance action is hash-chained with a SHA-256 receipt. Export a verifiable trail or a pre-filled ENISA/CSIRT notification.
Five layers, one principle: proprietary code never leaves your perimeter — only sanitised, signed evidence flows out.
CetraLog automates the technical evidence layer behind today's EU product-security mandates and defence procurement standards.
SBOM transparency, documented vulnerability handling, VEX-based triage, and coordinated-disclosure timelines — generated automatically.
Inbound SBOMs validated for required hashes, strict SPDX licensing, and field completeness before they ever enter your inventory.
Actively-exploited vulnerabilities flagged with due dates, ransomware status, and required remediation actions.
Supply-chain risk management — provenance verification, component integrity, and sovereign-feed advisory coverage.
Book a 30-minute walkthrough on a real SBOM — from ingestion to a signed, regulator-ready report.