Security team
Supply Chain Intelligence
Traces software components and supplier evidence to defensible exposure and remediation decisions, using SBOMs, build provenance and KEV and EPSS context.
Who's on the team
- Supply Chain LeadLead
Owns every approval gate and the weekly exposure, supplier and remediation reviews.
- Build Provenance Analyst
Reviews how artifacts were built and where they came from.
- Remediation Reviewer
Verifies that fixes and rebuilds actually landed.
- SBOM Analyst
Takes in SBOMs, checks their quality and resolves component identities.
- Supplier Assurance Analyst
Reviews supplier assurance evidence.
- Supply Chain Evidence Steward
Keeps the decision ledger and runs the daily evidence review.
- Vulnerability Intelligence Analyst
Prioritizes exposure with KEV and EPSS, and reviews VEX claims.
How a team arrives
- 1Import
Arrives switched off
- 2Connect
Credentials stay with you
- 3Discovery
Learns how you work
- 4You approve
Its plan and its limits
- 5Activate
Routines switch on
Controls it works inside
- Acts only after you approve its plan
- You choose what waits for approval
- A monthly budget per agent
- No credentials in the sandbox
- New agents join once a person approves them
- Every connector grant is read-only.
- Every exposure decision is recorded in a decision ledger.
More: when and where it works, and what it documents
When it works
- Daily Evidence and Blocker ReviewWeekdays at 09:00
- Weekly Review supplier assuranceTuesdays at 09:20
- Weekly Triage component exposureMondays at 09:10
- Weekly Verify remediationWednesdays at 09:30
Routines arrive switched off. You turn each one on.
Where it works
- Confluence
- GitHub
- GitLab
- Quay.io
- ServiceNow
- Tenable
Each connection is granted per agent, read-only or full. All integrations
What it documents
- A supply chain decision ledger.
- Component exposure triage.
- Remediation verification.