Supply-chain visibility

Two artifacts

Two artifacts for every image

Each repository gets a component inventory and a vulnerability assessment, kept side by side and addressed by content so identical layers are never re-processed.

SBOM: component & license inventory

A CycloneDX software bill of materials catalogs the packages, dependencies and licenses found inside the image. From mystery code to a complete, machine-readable inventory.

CycloneDXcomponentslicensesdependencies

Vulnerability report: CVE findings

The vulnerability report matches that inventory against a known-vulnerability database, recording severity, fix availability and a verdict you can gate on.

JSON reportCVEsseverityfixable

How it works

Generated on the way through

Nothing to install, nothing to run in CI or your cluster. Scanning happens in the proxy as the image is pulled, and reports re-scan themselves as the vulnerability database moves.

01
Pull through Sekyr
Your orchestrator pulls an image through the proxy, exactly as it does today.
02
Catalog the image
We inventory every component, dependency and license into a CycloneDX SBOM, per architecture.
03
Match against known CVEs
We match the inventory against a vulnerability database and record severity and fix state for each finding.
04
Re-scan on database updates
Reports re-run against a fresh vulnerability database, so CVEs disclosed after an image was built surface without a re-pull.

What's in a report

A verdict, not a wall of CVEs

Each report sorts findings into severity buckets, counts what is actually fixable, names the highest severity present, and returns a pass/fail verdict against a configurable threshold. It also records the scanner version, the vulnerability-database version and the time it ran.

Severity bucketsCounts across critical, high, medium, low and negligible.

Fixable countHow many findings have a fix available, which is what you can patch today.

Highest severityThe worst severity present, at a glance.

Pass / fail verdictA pass or fail result against a failOn threshold, for policy gating.

Scanner & DB versionThe scanner version and vulnerability-database version behind the result.

Scanned atWhen the scan ran, so you can prove freshness.

{
  "image": "sekyr.com/ghcr/acme/api",
  "digest": "sha256:7b1a9c2f3e8d4a16...",
  "architecture": "linux/amd64",
  "scannedAt": "2026-04-26T14:22:08Z",
  "scanner": { "version": "1.4.2", "vulnDb": "v6 2026-04-26" },
  "sbom": { "format": "cyclonedx-json", "components": 412 },
  "summary": {
    "bySeverity": {
      "critical": 1, "high": 6, "medium": 23, "low": 31, "negligible": 9
    },
    "fixable": 18,
    "highestSeverity": "critical"
  },
  "verdict": { "failOn": "high", "result": "fail" }
}

Illustrative report summary. Field values are examples, not a real scan.

Benefits & compliance

Evidence your auditors and customers ask for

Supply-chain visibility turns "what's in this image?" into a question you can answer on demand, with artifacts that map onto the frameworks B2B buyers and regulators expect.

Know what's in every image

A full component, dependency and license inventory in CycloneDX, taking you from mystery code to a complete bill of materials.

Continuous, not quarterly

Every pull triggers a scan, and reports re-scan against a fresh database, so a clean image yesterday isn't a blind spot tomorrow.

A clear verdict

Severity buckets, a fixable count and a pass/fail threshold let you triage by severity and fixability instead of reading a wall of CVEs.

Audit-ready evidence

A downloadable SBOM and vulnerability report per image and architecture gives you concrete answers for an auditor or a security questionnaire.

License visibility

License data travels in the CycloneDX SBOM, right alongside the CVE findings.

Zero install, agentless

Scanning runs at pull time in the proxy. Nothing to deploy in CI or your cluster.

Per repository, multi-arch

Scoped per image repository, with every architecture variant inventoried and scanned on its own.

Open tooling, no black box

Open CycloneDX SBOMs and JSON reports are portable into your own GRC, ticketing or policy tooling. No lock-in.

A foundation for the frameworks you report against

Sekyr holds no certification of its own, and known-CVE scanning at pull time is not a guarantee of safety. What these artifacts give you is machine-readable evidence and continuous tracking, the groundwork each framework asks for.

EU Cyber Resilience ActMachine-readable SBOMs and continuous vulnerability tracking are the foundation CRA's vulnerability-reporting and SBOM obligations build on, ahead of their deadlines in 2026 and 2027.
PCI-DSS v4.0Helps you risk-rank new vulnerabilities (Req 6.3.1) and scan on a cadence (Req 11.3.1), and pull-time plus re-scan goes beyond the quarterly floor.
EU NIS2 DirectiveProvides evidence for the vulnerability-handling and supply-chain risk-management measures NIS2 expects of essential and important entities across the EU and EEA.
SOC 2 (CC7.1) & ISO 27001 A.8.8SBOM and scan output is recognized evidence for the continuous, risk-based vulnerability management these attestations expect.
NIST SSDF (SP 800-218)A widely adopted secure-development framework; its call for ongoing SBOM generation and vulnerability monitoring is exactly what these artifacts produce.
CycloneDX (ECMA-424)CycloneDX is an internationally standardized SBOM format (ECMA-424), so the inventory we produce is portable and recognized across tools and frameworks.

This describes how the artifacts help you meet or provide evidence for each framework. Sekyr does not claim to be certified or authorized under any of them.

Formats & export

Open formats, exportable anywhere

Both artifacts are open, machine-readable and downloadable per image and architecture, so you can feed them into whatever you already run.

CycloneDX JSON

SBOM

The SBOM as a standard CycloneDX document: components, dependencies and licenses.

Vulnerability JSON

CVEs

The vulnerability report as machine-readable JSON: findings, severity, fix state and the summary verdict.

Portable by defaultDownloadable per image and architecture, ready to load into your own GRC, ticketing or policy tooling. Open formats mean no black box and no lock-in.

Two pillars

Fits with runtime detection

Supply-chain visibility tells you what is inside your images. Runtime detection tells you what they do once they run. Same proxy, same pull, two views of the same workloads.

SBOM + vulnerability reports

What's in your images

SBOMs and vulnerability reports cover components, licenses and known CVEs, generated at pull time.

What your images do

Behavioral detection over process execution, from patched binaries that report what actually runs.

Explore runtime detection

See it on your own images

Pull an image. Read its bill of materials.

Start a free trial with no agent install and no CI changes. An SBOM and a vulnerability report come with every pull.

Read the docs Talk to engineering