"Continuous SBOM: Why One Scan Isn't Enough"
An SBOM from January is useless if new CVEs are published in March. Continuous SBOM monitoring catches vulnerabilities the moment they're disclosed. Here's how to set it up.
You generated an SBOM. You scanned for vulnerabilities. You fixed everything. Ship it, right?
Not so fast. The CVE database updates daily. A dependency that was clean yesterday might have a critical vulnerability tomorrow. Without continuous monitoring, your SBOM becomes stale the moment it's generated.
Why One-Time Scanning Isn't Enough
Here's what happens with a one-time scan:
1. January: You scan your project — 0 vulnerabilities
2. February: A new CVE is published for requests
3. March: Your project is vulnerable, but nobody knows
4. April: An attacker exploits the vulnerability
5. May: You find out during a security audit (too late)
This isn't hypothetical. New CVEs are published every 2 hours. Your dependencies are constantly at risk.
What Continuous SBOM Monitoring Means
Continuous SBOM monitoring is the practice of:
1. Generating an SBOM for your project
2. Storing it as a baseline
3. Scanning daily for new CVEs against your existing SBOM
4. Alerting immediately when a new vulnerability affects your dependencies
5. Tracking resolution — knowing which CVEs are fixed and which are pending
How to Set It Up
Method 1: VulnLedger Dashboard (Easiest)
VulnLedger's dashboard provides continuous monitoring out of the box:
1. Sign up at vulnledger.com
2. Add your project
3. Run the first scan
4. Enable "SBOM Watch" in project settings
5. Get alerts when new CVEs are found
Method 2: Scheduled CLI Scans
# Daily scan via cron
0 8 * * * cd /path/to/project && vulnledger scan . --json --output daily-scan.json
# Compare with previous scan
# (VulnLedger dashboard does this automatically)
Method 3: CI/CD Scheduled Runs
# .github/workflows/continuous-scan.yml
name: Continuous Security Scan
on:
schedule:
- cron: '0 8 * * *' # Daily at 8 AM
workflow_dispatch: # Manual trigger
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- run: pip install vulnledger
- run: vulnledger scan . --json --output daily-scan.json
- uses: actions/upload-artifact@v4
with:
name: daily-scan
path: daily-scan.json
What to Monitor
New CVEs
The most critical monitoring: when a new CVE affects your dependencies.
How VulnLedger does it:
1. Stores your SBOM as a baseline
2. Re-scans daily against OSV.dev
3. Compares current scan with previous
4. Alerts you when new CVEs appear
License Changes
Licenses can change between versions. Monitor for:
- License changes in updated dependencies
- New dependencies with restrictive licenses
- License conflicts between components
Abandoned Packages
Monitor for:
- Packages with no updates in 6+ months
- Maintainer abandonment signals
- Package deprecation notices
New Dependencies
When you update dependencies, new transitive dependencies may appear. Monitor for:
- New packages in your dependency tree
- New CVEs in newly added packages
- License changes from new packages
Setting Up Alerts
VulnLedger Dashboard Alerts
Configure in your project settings:
- Instant alerts: Get notified immediately when new CVEs are found
- Email alerts: Receive daily/weekly digest of new vulnerabilities
- Slack alerts: Post to your team's Slack channel
GitHub Actions Alerts
- name: Check for new vulnerabilities
run: |
vulnledger scan . --json --output current.json
# Compare with previous scan
# Alert if new CVEs found
Custom Alerts
# Scan and check for critical CVEs
vulnledger scan . --json --output scan.json
CRITICAL=$(python3 -c "import json; print(json.load(open('scan.json'))['summary']['critical'])")
if [ "$CRITICAL" -gt 0 ]; then
echo "CRITICAL: $CRITICAL new critical CVEs found!"
# Send alert (email, Slack, etc.)
fi
Continuous SBOM Best Practices
1. Scan daily — new CVEs are published every 2 hours
2. Alert on critical/high — don't wait for weekly reports
3. Track resolution — know which CVEs are fixed vs pending
4. Compare scans — detect new vs resolved vulnerabilities
5. Automate everything — no manual scanning, no manual alerts
The Cost of Not Monitoring
Without continuous monitoring:
- Average time to detect a new CVE: 30-90 days
- Average time to exploit: days to weeks after disclosure
- Average cost of a breach: $4.45 million (IBM 2024)
With continuous monitoring:
- Detection time: minutes to hours
- Response time: same day
- Breach prevention: catching vulnerabilities before exploitation
How VulnLedger Helps
VulnLedger provides the complete continuous monitoring pipeline:
1. SBOM Watch — monitors your SBOM for new CVEs 24/7
2. Email alerts — instant notification for critical/high CVEs
3. Slack integration — post alerts to your team channel
4. Dashboard — track all vulnerabilities across all projects
5. Scheduled scans — daily/weekly automatic scanning
# One-time scan (baseline)
vulnledger scan . --json --output sbom.json
# Continuous monitoring via dashboard
# Sign up at vulnledger.com, add project, enable SBOM Watch
Frequently Asked Questions
Q: How often should I scan for new CVEs?
A: Daily. New CVEs are published every 2 hours on average. Weekly scanning misses too many. VulnLedger's dashboard does daily scans automatically.
Q: What if a new CVE affects a dependency I can't upgrade?
A: Monitor the package for updates. In the meantime, check if the vulnerable code path is actually used in your project. Many CVEs are theoretical — they don't affect every usage pattern. Add input validation or sandboxing as temporary protection.
Q: Can I monitor multiple projects at once?
A: Yes. VulnLedger's dashboard tracks all your projects in one place. The Team plan provides a centralized view across all team members' projects.
Q: What's the difference between SBOM Watch and scheduled scans?
A: SBOM Watch compares your current scan against previous scans to detect new CVEs. Scheduled scans just re-run the scan. SBOM Watch is more intelligent — it tells you what changed.
Q: How do I set up alerts?
A: In VulnLedger dashboard → Project Settings → Alerts. Configure email, Slack, or both. Set severity thresholds (e.g., only alert on critical/high).
Conclusion
An SBOM without continuous monitoring is a snapshot that becomes outdated the moment it's generated. New CVEs are published daily, and without monitoring, you won't know about them until it's too late. Continuous SBOM monitoring catches vulnerabilities the moment they're disclosed, giving you time to fix them before attackers exploit them.
Previous: SBOM for Compliance: EU CRA, FDA, NIST