From SBOM to VEX - Discovering What's in the Box and How Badly it Can Hurt You
summary
Compares full SBOM scans to an eBPF-based runtime filtering that records files touched by a running container, then intersects that with the SBOM to produce an “in‑use” SBOM and auto‑generated OpenVEX statements; claims a typical 80–90% reduction in reported vulnerabilities per image, demos with Kubescape + Inspector Gadget, emits OpenVEX output used by Grype/Trivy, and shows the approach works on real CNCF and general images.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 5:19SBOMs and VEX basics
- 14:11CNCF vs general container images
- 24:08In-use package filtering
- 32:54VEX practical value
- 39:54Key takeaways and VEX future
- 42:04Q&A: VEX adoption
- 44:54Q&A: Monitoring duration
- 47:46Q&A: Legal implications
- 48:30Q&A: Container alteration
- 49:37Q&A: Package bloat
- 52:05Q&A: Reachability analysis
- 55:14Closing
related talks
33mEnabling VEX and Full SBOM Coverage with Wolfi Based Containers
43mA radiography of a SBOM vulnerability scanner
29mUnlocking the Power of SBOMs: A Deep Dive into Risk Management and Cybersecurity Posture
27mSecuring Open Source With SBOM: From Visibility To Trust- 33mEnabling VEX and Full SBOM Coverage with Wolfi Based Containers
34mSBOMs: zero to hero in 25 mins!
47mI Can’t Cope! How OWASP Is Helping To Manage Vulnerability Overload
45mSmarter Than Your Average SBOM!