Why supply-chain teams use NexCyber
CRA Article 13 demands a documented vulnerability handling process tied to a continuously-maintained SBOM. NIS2 Article 21.2 demands supply chain risk management. AI Act Article 10 demands dataset provenance.
1. Multi-format SBOM ingest. CycloneDX 1.5+, SPDX 2.3+, syft / cosign attestations. The platform normalizes, deduplicates, and indexes per component.
2. CVE intelligence. OSV.dev + NVD + GHSA cross-referenced per dependency version. Flagged by CRA Article 13 severity tier (low / medium / high / critical).
3. Supply chain Trust Passport. Each upstream supplier gets a tier (Trusted / Verified / Unverified / At Risk) based on their SBOM hygiene + MRCC status + CVE backlog.
Three supply-chain use-cases
CRA Article 13 evidence pipeline. Each CI run pushes SBOM → platform tags vulnerabilities → evidence file with timestamp + signature → audit-ready.
NIS2 essential-entity supplier audit. Identify suppliers in your stack that themselves qualify as essential entities (NIS2 Annex I). Map their incident reporting obligations to your contract.
AI Act dataset provenance. For AI/ML systems, ingest dataset SBOM (DVC, CycloneDX-ML). Generate the dataset provenance evidence (AI Act Article 10).
Get started
Free SBOM ingest. Upload a CycloneDX JSON. See the intelligence report in 30 seconds. EU-hosted.