Tom Alrich's Blog

In our last OWASP SBOM Forum meeting before Thanksgiving, we started by discussing CISA’s new Request for Comments   on their recent docum...

There is widespread agreement in the NERC CIP community that it’s time – in fact, way past time – to fix the biggest problem with the CIP st...

In last week’s meeting of the SBOM Forum, toward the end of the meeting we somehow got onto the topic of whether SBOMs are succeeding in t...

I have written about a Global Vulnerability Database before, by which I meant a database that would be funded and run internationally. Ho...

Today, a very refreshing email was sent to the CISA VEX Workgroup mailing list: We're a small startup from Germany trying to establish...

  CISA recently published a  white paper on “Software Identification Ecosystem Option Analysis”. This paper is almost a textbook example of...

Red Hat came out with their new VEX format this week and described it in this blog post (Pete Allor of Red Hat also discussed it in today...