---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Checking a Software Bill of Materials entity for vulnerabilities

# Checking a Software Bill of Materials entity for vulnerabilities {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read

Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Checking a Software Bill of Materials Entity for Vulnerabilities

This guide helps ServiceNow customers determine if any vulnerabilities are linked to components in an uploaded Software Bill of Materials (SBOM) file.
To access vulnerability and enhanced data, ensure that specific applications are installed and activated, including SBOM Response and Vulnerability Response Integration with NVD and CWE jobs.
Show full answer Show less  

## Key Features

* **BOM Entities with Vulnerabilities Visualization:** This graph shows total vulnerabilities associated with components. The CVE, CWE, and Fixability columns indicate vulnerability presence, and can be added via the gear icon if not visible.
* **Component Record:** Selecting a component reveals its vulnerabilities on the Vulnerabilities tab. If no data appears, no vulnerabilities are reported.
* **Enhanced Vulnerability Data:** Access detailed vulnerability information through SBOM Response, including component states (Stale, Abandoned, Vulnerable) and version history.
* **Vulnerability Breakdown:** View vulnerabilities categorized by severity (CVE) and exploitability (CWE) on the component record.
* **Application Vulnerable Items (AVIs):** These items link vulnerabilities to applications based on rules set in the Software Bill of Materials Workspace.

## Key Outcomes

By utilizing the SBOM features, customers can effectively assess and manage risks associated with software components, ensuring they are aware of any vulnerabilities that might impact their applications. This proactive approach aids in maintaining security and compliance within their software environment.  
Determine whether any vulnerabilities are associated with the components in an uploaded Software Bill of Materials (SBOM) file.
The following applications must be installed and activated before you can view the vulnerabilities and enhanced vulnerability data:

* SBOM Response
* Vulnerability Response Integration with NVD and CWE jobs
* Vulnerability Response

{#vr-sbom-check-vulnerability-use-case__ul_hck_hmv_xzb}See [Exploring Software Bill of Materials](https://servicenow-prod.fluidtopics.net/8LjPHeECHwD3bz2tvjiDFg "Identify the components used in your organization's applications from Software Bill of Materials (SBOM) files you upload into your instance. Understand any risks associated with using open-source software to help you determine your potential exposure, view license compliance, and fix vulnerabilities.") for more information.

Role required: sn_sbom_resp.sbom_analyst

1. Navigate to AllSBOM WorkspaceComponents.
2. you can view vulnerability information either through a visualization or a component record. {#vr-sbom-check-vulnerability-use-case__choicetable_hff_zn2_11c__entry__2}

   | Method | Actions |
   |-|-|
   | BOM Entities with Vulnerabilities visualization | Select the BOM Entities with Vulnerabilities visualization graph. * If vulnerabilities are associated with this component, the totals are displayed in the CVE and CWE columns on the list. A component can have more than one vulnerability. If available, you can check the Fixability column on this list for entries. * If no vulnerabilities are associated with this component, these columns display 0 or no values for the component. {#vr-sbom-check-vulnerability-use-case__ul_nsf_d42_11c} If the CVE, CWE, and Fixibilty columns are not displayed, you can add them to the page by selecting the gear icon on the upper right of the page and Edit columns. Select them from the Available column list and select OK. |
   | Component record | 1. Select a record from the list below the visualizations. 2. Select the Vulnerabilities tab on the record. 1. If no data is displayed, no reported vulnerabilities are associated with the record. 2. If data is displayed, see [Reviewing the Components module in the Software Bill of Materials Workspace](https://servicenow-prod.fluidtopics.net/vinMTkns6OoBjyd_3bIzMQ "The Components module in the Software Bill of Materials (SBOM) Workspace displays current information about vulnerable, stale, abandoned, and high-risk combinations for the components you import.") and follow the steps in the remediation workflow for Application Vulnerability Response to address the vulnerability. For more information, see [Remediating Application Vulnerability Response vulnerabilities](https://servicenow-prod.fluidtopics.net/SAG31puYzw8j7ptbXYOugg "Monitoring remediation is a process that begins with reviewing status and ends with closing application vulnerable items (AVITs). Application Vulnerability Response offers tools and procedures to make that process more productive and efficient."). {#vr-sbom-check-vulnerability-use-case__ul_k5y_3p2_11c} {#vr-sbom-check-vulnerability-use-case__ol_ids_s42_11c} |
   [ ]

   {#vr-sbom-check-vulnerability-use-case__choicetable_hff_zn2_11c}

## Assessing your risk with vulnerability intelligence {#vr-sbom-check-vulnerability-use-case__section_q35_jfp_c1c}

View more enhanced vulnerability data with SBOM Response on component records. The SBOM Response application, Vulnerability Response, National Vulnerability Database (NVD) Integration and Common Weakness Enumeration (CWE) scheduled jobs described in [Supported applications](https://servicenow-prod.fluidtopics.net/eRMz24JKdGCJ15Mk0regPg "Download and activate the required applications for the Software Bill of Materials (SBOM) application prior to uploading files.") must be installed and activated.

1. Select the All Components visualization to view its list of associated records.
2. Select a link in the Name column to open a record.

   The States, Stale, Abandoned, and Vulnerable are displayed under the
   component name. A component can have any combination of these states. If no state is displayed, the component is not stale, abandoned, or vulnerable.

   Review the current version and the latest published version.
   In the right panel, you can view a version history. The current version is highlighted in the version history and its location in the list may provide you with insight as to why a component is
   Stale, Abandoned, and Vulnerable. For example, you might be using an older version of a component.
3. Select the Overview, Hashes, BOM Entities, Vulnerabilities, and AVIs related tabs on the record.
   * Overview - A summary of the component details.
   * BOM Entities - A list of the entities associated with this component.
   * Hashes - If imported, hashes are displayed.
   * Vulnerabilities - Information about known vulnerabilities associated with this component. If this list is empty, there are no known vulnerabilities. If the list is populated, select the tab to view
     vulnerability IDs, summaries, and other vulnerability information for Common Vulnerabilities and Exposures (CVE) and Common Weakness Enumeration (CWE) data associated with this record. CVEs are broken down by
     severity, CWEs are broken down by how likely the component can be exploited. You can view the enhanced vulnerability records in the Vulnerability Response or Application Vulnerability Response applications by selecting the vulnerability ID link.

   * AVIs (AVITs) - Application vulnerable items associated with this component if you have created AVIT creation rules that match the component to a known vulnerability. The Application Vulnerability Response application (AVR) relates a vulnerability to an application to create an AVI record. For more information, see [Creating rules for application vulnerable items in the Software Bill of Materials Workspace](https://servicenow-prod.fluidtopics.net/m6ujN_BtTJ66ag4jYReinQ "Before you can see application vulnerable items (AVITs) in the Software Bill of Materials (SBOM) Workspace, you must set up the conditions under which AVITs are created.").
   {#vr-sbom-check-vulnerability-use-case__ul_xgb_nfp_c1c}
{#vr-sbom-check-vulnerability-use-case__ol_wgb_nfp_c1c}

*[\>]: and then