Source dependencies
Include supported package manifests and exact lockfiles. Review recognized components, unresolved versions and the advisory information used before interpreting a zero-finding result.
Review SAST and dependency scope →Software supply chain security
Connect dependency findings
to the software you ship.
A package advisory, a source-code weakness and an unsafe deployment setting need different evidence. Use Offensive360 to investigate supported dependency inputs and source code, and evaluate image archives, SBOMs and Kubernetes manifests in the cloud demo.
Check each stage with the right input
Use a representative application and release artifact. Record where the inventory came from, which checks completed and what still needs investigation.
Your application code
Review source findings with concrete code context and remediation guidance. Framework behavior, authorization boundaries and runtime configuration may need additional investigation.
Explore source-code analysis →The built artifact
Evaluate a Docker/OCI image archive or CycloneDX/SPDX JSON SBOM in the cloud demo. Compare the analyzed inventory with the release you intend to deploy.
Explore container and SBOM scanning →Declared deployment configuration
Assess uploaded Kubernetes resource manifests for supported configuration checks. Live-cluster state, referenced image contents and runtime behavior are separate assessment questions.
Review manifest analysis scope →Turn an advisory into a practical fix
- Establish identity. Match the package ecosystem, name and exact version to the source lockfile or release artifact.
- Read the advisory. Check affected ranges, relevant conditions and available fixed versions. Severity helps prioritization; it does not establish reachability or exploitation.
- Choose and test the change. Check compatibility, upgrade the dependency or apply an appropriate mitigation, and run the application's tests.
- Rebuild and reassess. Verify the actual new artifact and retain the assessment scope, advisory context and unresolved items with the release decision.
For license obligations, malware investigation, provenance requirements or live runtime monitoring, specify the acceptance criteria separately and confirm the available capability. A vulnerability advisory scan does not establish these outcomes.
Questions to settle before your evaluation
What is software supply chain security?
Software supply chain security examines the components and processes used to build and deliver software. Dependency assessment, source review, artifact analysis and deployment-configuration review answer different questions and should be evaluated with explicit scope.
How do SCA and container image scanning differ?
Source dependency analysis uses supported manifests and lockfiles to identify components. Container image scanning examines supported package information in the supplied image archive. The inventories can differ because a build adds, removes or changes components. Assess the artifact you intend to ship as well as the source project.
What can an SBOM vulnerability assessment establish?
An SBOM describes components recorded by its producer. Matching recognized names and exact versions to advisory data can identify potential exposure. It does not prove that the inventory is complete, that all components are deployed, or that an advisory is exploitable in your application.
Does a clean dependency result prove that an application is secure?
No. Check that the expected dependencies were recognized, that analysis completed and that the advisory snapshot was suitable. Source-code weaknesses, unknown vulnerabilities and application-specific authorization or runtime issues require separate investigation.
Can I evaluate supply chain checks in a private environment?
Discuss the product release, supported analyzers, advisory updates and network requirements for your intended deployment. Cloud artifact scanning and an offline appliance are different evaluation scopes. Agree data handling and external AI settings before providing source code or artifacts.
The Offensive360 Team · Updated October 3, 2026. Product availability, scan capacity, deployment and support should be recorded in your commercial scope.