Exploitability & Consumption

## What an estate is An SBOM (software bill of materials) is a machine-readable list of the components inside **one artifact, at one version**. On its own it is a file sitting next to a build. An *estate* is what you get when every one of those files is ingested into a store, indexed by component coordinates, and joined to a record of which artifact is actually deployed where. The estate, not the individual document, answers the question a security team is really asked: **where do we run this component, and at which version?** ## Why regeneration is the wrong instrument Picture a bank running roughly 900 services. Overnight, an advisory lands for a widely used serialisation library, and the on-call needs the exposed list before the morning change window. The instinctive move is to scan everything again. Three things go wrong: 1. **Repositories are not production.** A source scan describes the current main branch. What is running is an artifact built from some earlier commit, with dependency resolution that happened at that moment, in that build environment. The two lists differ, and the difference is exactly where incidents hide. 2. **Rebuilding at the deployed commit is often impossible.** Toolchains have moved, mirrors have drifted, credentials have rotated. Reproducing a nine-month-old build to ask it a question is a project, not a lookup. 3. **Time.** A rescan fleet across hundreds of repositories takes hours. The answer arrives after the decision had to be made. The estate pays that cost once, at build time, where the information is cheapest and most accurate, and then serves it as a query. ## What each record must carry A record ties three things together: - **The document** as it was received, stored verbatim, so you can re-derive facts later and so an auditor can see what you were told. - **The subject artifact's immutable identity** — the digest of the built image or package. Not a tag, which moves, and not a repository name, which produces many artifacts. - **A join to deployment**: artifact digest to environment, service, cluster or device fleet. A query then walks backwards: component coordinate to the documents that list it, to the artifact digests those documents describe, to the places those digests are running. ## Index coordinates, not display names Component names collide across ecosystems and change over time, so string matching produces both false negatives (a renamed package) and false positives (one word, two ecosystems). An ecosystem-qualified coordinate such as `pkg:npm/[email protected]` — the purl scheme — makes the match deterministic. Version comparison must follow the ecosystem's own ordering rules, because advisories describe **ranges**, not points; a naive lexical comparison puts `1.10.0` before `1.9.0` and quietly drops services from the answer. Keep both layers: the raw document for audit and reprocessing, and a normalised index for the query. You will change your mind about normalisation, and re-deriving from stored documents is far cheaper than re-collecting them. ## What the estate does not tell you Three limits, and confusing any of them for coverage is the classic mistake: - **It lists components, not exploitability.** That a vulnerable component is present says nothing about whether the vulnerable code is called or whether an attacker can reach it. That is a separate assessment on top of the inventory. - **It is only as complete as the documents in it.** Components a generator could not see are simply missing, and a missing component is invisible to every query you will ever run. - **It ages relative to what you deploy.** A document is a statement about a specific artifact version; it stops being useful the moment you run a different one. ## Positive and negative answers are not equally strong 'We run it in twelve services' is cheap to act on — you have twelve concrete things to look at, and each can be confirmed. 'We do not run it anywhere' is a much bigger claim: it asserts that the estate covers everything you deploy and that every document in it is complete. A junior answer that treats an empty result as proof of absence is the single most dangerous habit in this area. The honest formulation is 'no document in the estate lists it', paired with a statement of how much of the fleet the estate actually covers.