Question 1

What is ShieldVUE and what problems does it solve?

Accepted Answer

ShieldVUE is a Software Supply Chain Security platform that provides Software Bill of Materials (SBOM), Software Composition Analysis (SCA), Cryptographic Bill of Materials (CBOM), AI Bill of Materials (AIBOM), and continuous vulnerability intelligence to help organizations identify, manage, and remediate software supply chain risks throughout the software lifecycle.

Question 2

What is the difference between SBOM, CBOM, AIBOM and HBOM?

Accepted Answer

SBOM inventories software components and dependencies, CBOM inventories cryptographic assets such as algorithms, certificates and keys, AIBOM inventories AI/ML models and their dependencies, while HBOM provides visibility into hardware components, firmware, and embedded systems.

Question 3

What is the difference between SBOM, Vulnerability Assessment (VA) and Penetration Testing (PT)?

Accepted Answer

SBOM identifies software components and dependencies, Vulnerability Assessment identifies known security weaknesses, while Penetration Testing validates whether those weaknesses can be practically exploited in real-world attack scenarios.

Question 4

How does ShieldVUE complement existing VA/PT and Vulnerability Management tools?

Accepted Answer

ShieldVUE provides component-level visibility before deployment, continuously tracks newly disclosed vulnerabilities, and enriches VA/PT findings with precise dependency information, remediation guidance, and software supply chain intelligence.

Question 5

How does ShieldVUE compare with competing SBOM solutions?

Accepted Answer

ShieldVUE combines SBOM, CBOM, AIBOM, AI-powered remediation, continuous vulnerability monitoring, enterprise integrations, flexible deployment models, and software supply chain governance within a single unified platform.

Question 6

Why is ShieldVUE required if software vendors already provide SBOMs? Why should vendor-provided SBOMs be validated against internally generated SBOMs?

Accepted Answer

Vendor-provided SBOMs are often static and may not accurately reflect the software deployed within your environment. ShieldVUE independently generates SBOMs from deployed applications, validates vendor-supplied SBOMs, identifies discrepancies, and continuously updates software inventories through CI/CD integration.

Question 7

How does ShieldVUE generate SBOMs?

Accepted Answer

ShieldVUE automatically generates industry-standard SBOMs by scanning source code, binaries, containers, directories, packages, and build artifacts using standards-compliant analysis techniques supporting SPDX and CycloneDX formats.

Question 8

Does ShieldVUE support both agent-based and agentless scanning?

Accepted Answer

Yes. ShieldVUE supports both agent-based and agentless scanning depending on deployment architecture and customer requirements.

Question 9

Which artifacts can ShieldVUE scan?

Accepted Answer

ShieldVUE supports scanning source code repositories, Git repositories, JAR/WAR/EAR files, ZIP/TAR packages, binaries, Docker images, OCI containers, Kubernetes workloads, directories, and other commonly used build artifacts.

Question 10

Can ShieldVUE scan vendor-developed applications?

Accepted Answer

Yes. ShieldVUE can generate SBOMs for vendor-developed applications even when only binary packages are available.

Question 11

Can ShieldVUE scan internally developed applications?

Accepted Answer

Yes. ShieldVUE supports applications developed in-house across multiple programming languages and build systems.

Question 12

Can ShieldVUE scan standalone C/C++ applications?

Accepted Answer

Yes. ShieldVUE supports standalone native applications including C and C++ binaries.

Question 13

Can ShieldVUE scan monolithic as well as microservice-based applications?

Accepted Answer

Yes. ShieldVUE supports both traditional monolithic applications and modern microservices architectures.

Question 14

Can ShieldVUE support multiple environments like DEV, UAT, DR and Production?

Accepted Answer

Yes. ShieldVUE supports separate scanning, reporting, and governance across Development, UAT, DR, Staging, and Production environments.

Question 15

What deployment models are supported?

Accepted Answer

ShieldVUE supports On-Premises, Private Cloud, SaaS, Hybrid, and fully Air-Gapped deployments.

Question 16

Does ShieldVUE support LDAP integration?

Accepted Answer

Yes. ShieldVUE integrates with enterprise LDAP and Active Directory for centralized authentication and user management.

Question 17

Can ShieldVUE integrate with CI/CD pipelines?

Accepted Answer

Yes. ShieldVUE integrates seamlessly with popular CI/CD platforms, enabling automated SBOM generation and vulnerability analysis during software builds.

Question 18

Can ShieldVUE integrate with existing Vulnerability Management, Patch Management and Change Management tools?

Accepted Answer

Yes. ShieldVUE integrates with enterprise Vulnerability Management, Patch Management, ITSM, DevSecOps, and Change Management platforms through APIs and automation workflows.

Question 19

What information is available on the ShieldVUE dashboard?

Accepted Answer

The dashboard provides application-level security posture including SBOM Score, Risk Score, vulnerability summaries, severity distribution, scan history, component inventory, compliance insights, and detailed drill-down analytics.

Question 20

How is the SBOM Score calculated?

Accepted Answer

ShieldVUE calculates an overall SBOM Score using proprietary scoring algorithms that consider multiple parameters including vulnerability severity, EPSS, exploitability, End-of-Life components, dependency health, and additional software supply chain risk indicators.

Question 21

What reports are available?

Accepted Answer

ShieldVUE provides SBOM, CBOM, Vulnerability Assessment, Compliance, Executive Summary, Technical Analysis, and Audit reports.

Question 22

Can reports be exported in PDF and Excel formats?

Accepted Answer

Yes. Reports can be exported in PDF, Excel, SPDX, CycloneDX, JSON, and other supported formats.

Question 23

Can reports be automatically emailed?

Accepted Answer

Yes. ShieldVUE supports scheduled email notifications and automatic distribution of reports upon scan completion or based on configured schedules.

Question 24

How does ShieldVUE identify vulnerabilities?

Accepted Answer

ShieldVUE correlates discovered software components against trusted vulnerability databases and threat intelligence sources to identify known vulnerabilities affecting each component.

Question 25

Which vulnerability databases and Threat Intelligence feeds are used?

Accepted Answer

ShieldVUE utilizes multiple trusted sources including NVD, CVE, NIST, vendor security advisories, OEM databases, and additional threat intelligence feeds to provide comprehensive vulnerability coverage.

Question 26

Does ShieldVUE support Zero-Day vulnerability intelligence?

Accepted Answer

Yes. ShieldVUE supports near real-time vulnerability intelligence updates, with data refresh intervals as low as 30 minutes depending on deployment configuration.

Question 27

How are common vulnerable components identified across multiple applications?

Accepted Answer

ShieldVUE correlates SBOMs across all applications to identify shared vulnerable components, enabling organizations to prioritize remediation efforts that maximize overall risk reduction.

Question 28

Can ShieldVUE perform continuous vulnerability monitoring after initial SBOM generation?

Accepted Answer

Yes. Once an SBOM has been generated, ShieldVUE continuously monitors newly disclosed vulnerabilities affecting that software version without requiring repeated code scans.

Question 29

Does ShieldVUE support scheduled and on-demand scans?

Accepted Answer

Yes. ShieldVUE supports both scheduled automated scans and user-initiated on-demand scans.

Question 30

Can SBOMs be compared across versions?

Accepted Answer

Yes. ShieldVUE provides version comparison capabilities to identify added, removed, upgraded, and vulnerable components between software releases.

Question 31

How does automated vulnerability reporting work?

Accepted Answer

Users can configure scheduled vulnerability scans, automated report generation, and email notifications based on organizational policies and reporting schedules.

Question 32

How does AI-based remediation work?

Accepted Answer

ShieldVUE's AI-powered remediation engine analyzes dependency graphs and vulnerability data to recommend remediation actions that maximize risk reduction while minimizing development effort.

Question 33

Does AI Remediation require Internet connectivity?

Accepted Answer

No. AI Remediation can operate entirely within customer-controlled environments without Internet connectivity.

Question 34

Can AI Remediation work in Air-Gapped environments?

Accepted Answer

Yes. ShieldVUE fully supports AI-powered remediation in secure air-gapped environments.

Question 35

Can ShieldVUE automatically create Git Merge Requests for fixes?

Accepted Answer

Yes. ShieldVUE can generate remediation recommendations and optionally create Git Merge/Pull Requests for supported source code repositories.

Question 36

Is AI Remediation optional or mandatory?

Accepted Answer

AI Remediation is an optional module and can be licensed independently based on customer requirements.

Question 37

If a vulnerability is accepted as a risk, how is it handled in future scans and reports?

Accepted Answer

Accepted risks remain documented for audit purposes and governance while being excluded from repeated operational alerts until the acceptance period expires or policies change.

Question 38

Does ShieldVUE integrate into Secure SDLC?

Accepted Answer

Yes. ShieldVUE integrates throughout the Secure SDLC by enabling early software composition analysis, continuous vulnerability monitoring, policy enforcement, and remediation guidance.

Question 39

Can developers remediate vulnerable components before SAST and DAST?

Accepted Answer

Yes. By identifying vulnerable third-party components early, ShieldVUE enables developers to remediate software supply chain risks before executing SAST, DAST, and penetration testing activities.

Question 40

What cryptographic assets are covered under CBOM?

Accepted Answer

ShieldVUE inventories cryptographic algorithms, cryptographic libraries, certificates, keys, key stores, protocols, initialization vectors (IVs), random number generators, hashing algorithms, encryption configurations, and other cryptographic assets.

Question 41

Is ShieldVUE applicable only for RBI/SEBI compliance or can it be used globally?

Accepted Answer

ShieldVUE supports globally recognized software supply chain security practices and helps organizations comply with Indian regulations (such as CERT-In, RBI, SEBI) as well as international frameworks and standards.

Question 42

How is customer data protected while using AI-powered features?

Accepted Answer

ShieldVUE protects customer data through secure deployment models, role-based access control (RBAC), encryption, audit logging, and on-premises AI capabilities where required, ensuring sensitive source code and metadata remain within customer-controlled environments.

Question 43

What is the typical duration of a ShieldVUE POC?

Accepted Answer

A typical Proof of Concept (POC) is completed within approximately two weeks, depending on the number of applications, deployment environment, and integration requirements.

Got Questions?
We've Got Answers

Browse by Category

Product Overview

SBOM Gen. & Discovery

Deploy & Integrations

Dashboard & Reporting

Vulnerability Intel

AI Remediation

Risk Governance

CBOM & Cryptography

Compliance & Security

Implementation

Still have questions?

Got Questions? We've Got Answers