Executive Summary

ERMITS™ is an enterprise risk intelligence platform that bridges Enterprise Risk Management (ERM) and IT Security (ITS). It translates technical security evidence — including SBOMs, software dependencies, vendor data, and regulatory mappings — into decision-grade insights for executives, boards, and advisors.

In this demonstration, ERMITS uses SBOMs as one of the primary bridges between technical reality and enterprise risk decisions. Instead of relying on self-reported vendor questionnaires, the platform enables consultants and internal teams to deliver evidence-based software supply-chain risk analysis as a differentiated advisory and governance service.

Evidence-Based Risk Assessment

Transition from trust-based vendor questionnaires to technical verification of software composition and vulnerabilities

Multi-Stakeholder Communication

Single SBOM analysis generates perspectives for board, risk officers, compliance, procurement, legal, and technical teams

Rapid Analysis Capability

SBOM vulnerability analysis completed in minutes rather than manual multi-day processes

Client-Controlled Environment

Privacy-first architecture processes sensitive client data within their infrastructure, addressing data sovereignty requirements

This demonstration presents a practical workflow: SBOM ingestion, automated vulnerability correlation via public APIs (NIST NVD, OSV.dev, CISA KEV), stakeholder-specific report generation, and natural pathway to expanded cybersecurity program visibility.

Enterprise Challenges

1. Fragmented Asset Management

Disconnected tools, manual processes, and delayed intelligence create operational inefficiencies:

  • Separate systems for inventory, SBOM analysis, vendor risk, and compliance
  • Manual classification and routing overhead
  • No automated intelligence layer
  • Weeks to actionable insights

2. Stakeholder Communication Gap

Traditional SBOM tools produce technical reports unusable by non-technical stakeholders. Each audience needs different information:

  • Board: Business risk ($ impact), not CVE counts
  • CRO: ERM framework alignment
  • Compliance: Regulatory evidence & audit docs
  • Procurement: Vendor risk & contract compliance
  • Legal: License compliance & liability exposure
  • Security: Technical remediation guidance

3. Trust-Based vs. Verification-Based Risk Assessment

Vendor risk management relies on self-attestation rather than technical verification, creating blind spots:

  • Security questionnaires & certifications validate processes, not code
  • Point-in-time assessments provide no continuous visibility
  • No insight into actual software composition & dependencies
  • Supply chain attacks (SolarWinds, Kaseya) demonstrate the risk
Traditional Methods: Questionnaires, SOC 2, Pen Testing → Reveal policies & active exploits, miss dependency risks
SBOM Analysis: Technical verification → Complete software composition visibility

ERMITS ERM + IT Security Workflow (SBOM Example)

SBOM Upload
3-Minute Analysis
6 Stakeholder Reports

In this example, a single SBOM upload generates automated vulnerability analysis and six decision-ready stakeholder perspectives. View detailed technical specifications →

Traditional vs. ERMITS Approach

Traditional Model

  • 40+ hours manual translation per SBOM
  • Multiple uncontrolled document versions
  • Inconsistent risk interpretation
  • High error rate in translation

ERMITS Model

  • Single SBOM upload
  • 3-minute automated analysis
  • Six synchronized stakeholder views
  • Zero translation errors

Four-Step Automated Workflow

1

SBOM Upload & Validation

Supports SPDX, CycloneDX, SWID formats

  • Format validation and parsing
  • NTIA minimum elements verification
  • Component completeness assessment
2

Vulnerability Analysis

Real-time intelligence from multiple sources

  • NIST NVD & OSV.dev queries
  • CISA KEV catalog correlation
  • EPSS exploit probability scoring
3

Risk Quantification

Severity classification and prioritization

  • CVSS severity scoring
  • Dependency blast radius analysis
  • Exploitation likelihood assessment
4

Multi-Stakeholder Reports

Six perspectives generated simultaneously

  • Board, CRO, Security, Compliance
  • Procurement, Legal perspectives
  • PDF, web dashboard, API exports

Privacy-First Architecture: All processing occurs within client-controlled infrastructure. On-premise deployment option addresses data sovereignty requirements.

Multi-Stakeholder SBOM Reporting

One SBOM analysis generates six distinct, decision-ready perspectives

Generated automatically by the Unified Intelligence Platform. See interactive demo of stakeholder reports →

Board & Executive View

Focus: Strategic risk assessment and business impact

  • Quantified breach risk analysis
  • Executive risk heatmaps
  • Regulatory readiness assessment (EO 14028, SEC requirements)
  • Cyber insurance optimization recommendations
Key Metrics:
  • Business impact: Potential breach cost analysis
  • Risk level: Critical
  • Action required: Immediate board notification

Chief Risk Officer (CRO) View

Focus: Enterprise risk management framework alignment

  • COSO and ISO 31000 framework mapping
  • Third-party risk evidence documentation
  • Dependency concentration risk analysis
  • Audit-ready documentation generation
Key Deliverables:
  • ERM framework alignment documentation
  • Risk register integration data
  • Third-party risk scoring matrices
  • Concentration risk analysis reports

CISO & Security Team View

Focus: Technical execution and remediation

  • Detailed CVE information with EPSS scores
  • Dependency blast radius analysis
  • Patch prioritization recommendations
  • Continuous monitoring alert configuration
Technical Details:
  • 23 CVEs identified
  • 5 Critical severity (CVSS ≥ 9.0)
  • EPSS Score: 0.87 (high exploit probability)
  • 2 vulnerabilities in CISA KEV
  • Recommended action: Upgrade to version 2.17.1

Compliance & Audit View

Focus: Regulatory compliance and audit readiness

NTIA SBOM Elements Compliance

Element Status
Supplier Complete
Component IDs Complete
Versions Complete
Dependencies Complete
Author Partial
Timestamp Complete

Framework Mapping

  • NIST Cybersecurity Framework 2.0
  • ISO 27001:2022
  • PCI DSS 4.0
  • SOC 2 Type II
  • CMMC 2.0
  • GDPR, CCPA
Audit-Ready Documentation:
  • Complete compliance evidence package
  • Framework control mappings
  • Remediation tracking documentation
  • Reduced audit duration

Procurement & Vendor Management View

Focus: Vendor risk assessment and contract compliance

  • Vendor SBOM quality scoring
  • Patch responsiveness metrics
  • Vendor comparison benchmarking
  • Contractual SBOM clause compliance
Vendor Risk Metrics:
  • SBOM completeness: 89%
  • Vulnerability response time: 14 days
  • Patch deployment rate: 67%
  • Contract compliance: Partial

Legal & License View

Focus: License compliance and liability exposure

  • Open-source license inventory
  • GPL contamination risk assessment
  • Liability exposure analysis
  • Attribution documentation
License Analysis:
  • Apache-2.0: 127 components
  • GPL-3.0: 3 components (review required)
  • MIT: 45 components
  • Proprietary: 12 components

Quantified Business Value

Process Efficiency

  • SBOM vulnerability analysis: Minutes vs manual multi-day review
  • Multi-stakeholder report generation: Automated vs manual preparation
  • Vulnerability correlation: API-driven vs manual database queries
  • Format standardization: Consistent output structure

Advisory Service Value

  • Repeatable analysis capability for vendor assessments
  • Scalable SBOM review process across client vendor portfolios
  • Technical verification supplement to questionnaire approaches
  • Evidence-based risk assessment documentation
  • Standardized reporting for consistent advisory deliverables
  • M&A due diligence software composition analysis

Operational Characteristics

  • Demonstration Capability: Proof-of-concept within advisory meeting
  • Analysis Speed: Suitable for time-sensitive assessments
  • Consistency: Standardized methodology across engagements
  • Flexibility: Multiple stakeholder communication formats

Platform Summary

SBOM-Based Supply Chain Risk Assessment for Advisory Services

ERMITS Platform Capabilities
SBOM Analysis • Vulnerability Correlation • Multi-Stakeholder Reporting

Key Characteristics

  • Client-Controlled Deployment – On-premise option addresses data sovereignty concerns
  • Unified Analysis Framework – Single SBOM generates multiple stakeholder perspectives
  • Automated Vulnerability Correlation – API integration with public vulnerability databases
  • Audit Trail Capabilities – Activity logging and role-based access controls
  • Compliance Framework Mapping – Supports alignment with SOC 2, ISO 27001, NIST, CMMC 2.0
  • Rapid Proof-of-Concept – Web-based interface for demonstration and initial analysis
Design Approach:
Evidence-based assessment → Multi-perspective communication → Risk-informed decision support

Interactive Demonstration

Experience the complete SBOM analysis workflow with real business software scenarios.

Launch Interactive Demo

Demo Features:

  • Select from 3 real business software scenarios (HR, Finance, CRM)
  • Watch automated vulnerability analysis with live API queries
  • View vulnerability distribution across severity levels
  • Generate customized reports for 6 different stakeholders
  • See detailed report previews with actionable recommendations

Note: For detailed technical specifications, API documentation, and implementation guidance, visit the Technical Appendix. For competitive positioning and market analysis, see the Market Analysis.

About ERMITS

ERMITS provides SBOM analysis and supply chain risk assessment capabilities designed for enterprise advisory services.

The platform addresses the transition from questionnaire-based vendor risk assessment to evidence-based technical verification through software bill of materials analysis. Designed for deployment in client-controlled environments, ERMITS supports data sovereignty requirements while enabling automated vulnerability correlation via public API integration (NIST NVD, OSV.dev, CISA KEV). The platform generates stakeholder-specific reports from single SBOM analysis, supporting communication across technical, risk, compliance, and executive audiences in advisory engagements.