What I do Four areas where deep expertise changes the outcome.
Each engagement is scoped to your program maturity, timeline, and regulatory posture. Most clients start with a focused assessment and expand from there.
Practice area Software Bill of Materials (SBOM) and xBOM strategy
Design, implement, and operationalize a production grade Software Bill of Materials (SBOM) program using CycloneDX. Covers generation, quality, distribution, vulnerability and exploitability transparency through Vulnerability Disclosure Reports (VDR) and Vulnerability Exploitability eXchange (VEX), attestations, and expansion into Cryptography Bill of Materials (CBOM), Machine Learning Bill of Materials (ML‑BOM), Software as a Service Bill of Materials (SaaS‑BOM), and Manufacturing Bill of Materials.
Practice area Regulatory readiness
Map your software supply chain program to the EU Cyber Resilience Act (CRA), U.S. Executive Order 14028, the NIST Secure Software Development Framework (SSDF), U.S. Food and Drug Administration (FDA) premarket cybersecurity guidance, and related mandates. Translate obligations into engineering backlog items rather than legal anxiety.
Practice area Supply chain hardening
Reduce risk across the software you build and the software you consume. The OWASP Software Component Verification Standard (SCVS) sets the high level requirements calibrated to your risk tolerance, paired with threat modeling for the supply chain, component intelligence, vulnerability prioritization, open source policy, and provenance verification at scale.
Practice area Executive advisory and training
Board briefings, maturity assessments, and private training for security, product, and engineering leaders. Keynotes and workshops calibrated to your audience, from first time SBOM readers to teams deploying cryptographic transparency.