Question 1

What is an SBOM and why do I need one?

Accepted Answer

A Software Bill of Materials (SBOM) is a complete inventory of all components in your software. It's essential for understanding your security posture, managing vulnerabilities, and meeting compliance requirements. With increasing regulatory pressure and supply-chain attacks, having an accurate, up-to-date SBOM is critical.

Question 2

How is exploit-aware scanning different from traditional CVE scanning?

Accepted Answer

Traditional scanners report all CVEs, creating noise and alert fatigue. Exploit-aware scanning prioritizes vulnerabilities that have known exploits in the wild, helping you focus on real risks first. Trace-AI integrates multiple threat intelligence sources to determine exploitability.

Question 3

Which programming languages and package managers do you support?

Accepted Answer

Trace-AI supports all major ecosystems including npm/yarn (JavaScript), pip (Python), Maven/Gradle (Java), Go modules, RubyGems, NuGet (.NET), Cargo (Rust), and more. Support for new package managers and languages is continuously added.

Question 4

Is my code and data secure?

Accepted Answer

Yes. Trace-AI only analyzes dependency manifests and lock files – never your source code. All data is encrypted in transit and at rest. Access is limited to your dependencies file, and the workflow is metadata driven. You can also run ZSBOM locally for complete control.

Question 5

How does ZSBOM compare to other SBOM tools?

Accepted Answer

ZSBOM is fully open-source and transparent. Unlike black-box commercial tools, you can audit its classification logic, customize risk scoring, and contribute improvements. Trace-AI focuses on accuracy, exploit-awareness, and developer experience.

Question 6

What compliance frameworks do you support?

Accepted Answer

Trace-AI maps SBOM data to ISO 27001, SOC 2, PCI-DSS, HIPAA, and GDPR requirements. Its policy-as-code library includes pre-built compliance checks that you can fork and customize for your specific needs.