Vulnerability Exploitability eXchange
Separates 'a CVE exists in a dependency' from 'it is exploitable in our product', with machine-readable justifications.
Spec focus
vulnerabilities[].analysis (state, justification)
Graph labels
BomDocument, Vulnerability, VexAnalysis, Component
Lifecycle
post-build
Mapping. analysis is a :VexAnalysis node (state, justification, response, detail) rather than a nested object, so status can be versioned.
Extension. VEX documents RELATED_BOM both the VDR and the SBOM they speak about, enabling 'show me unresolved exploitable paths'.
Documents
HarborPulse VEX 2026-Q1
urn:uuid:7a2e1c90-aa11-4b33-9d01-vex00009
Subject — · v2 · 2026-03-22T09:30:00Z
Open in graphNeighborhood
Drag to pan · scroll to zoom · 12 nodes · 11 edges
Select a node to inspect CycloneDX properties.
Sample Cypher
All BOM documents
Every CycloneDX document in the Atlas graph, with its type.
VEX exploitability status
Which CVEs are exploitable, in triage, or not affected in this product.
Exploitable paths to hardware
From an exploitable CVE, walk software dependents until a device is reached.
Components shared across BOM types
Inventory that appears in more than one BOM variety — the knowledge-graph payoff.
Knowledge concept overlay
How CycloneDX instances map onto the Atlas ontology.
Graph size by label
How many Atlas nodes exist for each CycloneDX class.
Neighborhood of HarborPulse API
One- and two-hop context around the application component.
Whether a vulnerability is actually exploitable in this product.