In today’s world, where everything from coffee machines to industrial equipment is connected to the network, knowing and assessing the security of your software and its dependencies has never been more important. Most vulnerabilities originate from small bugs in software components, and more recently (and thankfully less frequently) from sophisticated supply chain attacks. But with devices exposed to the internet, those bugs can become entry points for attackers on the other side of the world.
Modern systems are also built on a large foundation of open-source components: libraries, kernels, build tools, and third-party dependencies that make up a significant share of the final firmware image. While open source accelerates innovation and helps spread development costs, it also introduces a continuous flow of upstream updates and vulnerability disclosures that teams must track and manage.
SBOMs (Software Bill of Materials) have emerged as a best practice for making this software composition transparent. However, scanning SBOMs for vulnerabilities is often harder than it should be, especially in embedded environments, where many product designers lack cybersecurity expertise and the resources to perform full audits without automated tools.
Furthermore, the EU Cyber Resilience Act (CRA) mandates that manufacturers of connected products with digital elements create and maintain a Software Bill of Materials that documents components and vulnerabilities and serves as the basis for continuous monitoring as new issues emerge. While public disclosure is not required, manufacturers must provide this information to market surveillance authorities upon request.
That’s why we created VulnScout: to help organizations achieve their security and compliance requirements for the embedded systems they develop.
VulnScout is an SBOM-first vulnerability scanner designed to be developer-friendly and easy to integrate with Yocto, Buildroot, and most systems that generate SBOMs. It supports SPDX, CycloneDX, and OpenVEX SBOMs, enabling streamlined vulnerability detection and exploration at the build level with minimal setup and configuration. It bridges the gap between security tooling and day-to-day software development, particularly in projects with dozens or hundreds of open-source dependencies.
Many existing tools are excellent at what they do, but they often come with trade-offs that limit their usefulness as a single source of truth for project-level vulnerability assessment:
But what if you just want to:
That’s where VulnScout comes in.
Unlike many other tools that require a persistent web and database infrastructure, VulnScout is fully self-contained. It runs locally, stores its state within your project repository, and integrates directly with your build system, making CVE assessments version-controlled and part of your release process.
VulnScout helps teams keep track of which components are vulnerable, which ones have been fixed, and which ones still need attention. This history is preserved in the repository, making it part of your engineering workflow and auditable over time.
While other solutions are tightly coupled to specific data formats, VulnScout is format-agnostic and supports SPDX 2.x, SPDX 3.0, CycloneDX, and OpenVEX out of the box, eliminating the need for format conversion. VulnScout can also act as a conversion and reporting tool, allowing you to transform SBOM inputs into:
This makes it ideal for both automated builds and preparing audit documentation, especially when you need to demonstrate how you’ve addressed vulnerabilities across your open-source dependencies.
Instead of analyzing binaries or source code directly, VulnScout focuses on SBOM inputs. It consumes formats like SPDX, CycloneDX, Grype JSON, and Yocto CVE-check JSON, enriching them with data from:
Once scanned, VulnScout generates:
It is designed to run locally, either plugged into a Yocto or Buildroot setup or via a Docker container, and can be triggered with a single script (vulnscout.sh) or a Yocto layer (meta-vulnscout). This workflow allows you to continuously monitor open-source components as part of every build, catching regressions and new disclosures early.
You can get started with VulnScout in just a few minutes.
Check out the VulnScout GitHub repository for installation instructions, examples, and quick-start guides. If you use Yocto, check out meta-vulnscout, allowing for seamless integration with your image recipes.
Run it locally or in your CI pipeline to keep your open-source components under continuous watch and stay ahead of new vulnerabilities.
2024 was particularly rewarding for Savoir-faire Linux. We had the opportunity to take part in key events accross the Energy and Embedded sectors. We have built new partnerships and strenghtened our position in Open Source communities. We also had the pleasure to sponsor two events this year, the LF Energy Summit and Montréal Python. In […]
Keeping up with our 2023 retrospectives, we wished to highlight the contributions we made throughout the year to the various open-source projects we use on a daily basis for our needs and those of our customers, or those in which we are strategically involved in their development or maintenance. As a member of the Yocto […]
Hello ! My name is Emma Falkiewitz and I am 21 years old. I am in my 4ᵉ year of computer science school at Compiègne University of Technology (the UTC) in France. I just finished my internship at Savoir-faire Linux where I worked on Jami. How did this career choice come about? In high school, […]
2023 was a very prolific year for Savoir-faire Linux. To mark the announcement of our sponsorship of the LF Energy Summit 2024, we were keen to share a retrospective of the conferences we took part of in 2023. With captivating projects thanks to our R&D investments and our customers, we were able to present our […]
Our personal and professional lives are often punctuated by encounters with men and women who have left their mark and inspired us, whether through their skills, their social or political commitment, their vision or their leadership. We have this tradition at Savoir-faire Linux of paying tribute to some of these remarkable personalities and highlighting their […]
