Skip to main content

What is Threat Detective?

Understand how Threat Detective organises your work into organisations, projects, software items, versions, components and findings, and what happens to an SBOM after you upload it.

Written by Alan Parkinson

Threat Detective helps medical-device manufacturers manage software bills of materials (SBOMs) and vulnerability documentation for regulatory submissions and post-market surveillance. You upload an SBOM, we match its components against public vulnerability databases, you record triage decisions with a full audit trail, and the app generates submission-ready reports.

How your work is organised

Everything in Threat Detective sits in a simple hierarchy:

  • Organisation: your company or team. Members, suppliers and billing live here.

  • Project: one medical device or product. Projects group the SBOMs and versions for a single device, and hold the device details (trade name, model, submission reference) printed on your reports.

  • Software item: a piece of software you track within a device, named per IEC 62304. A device might have one software item or several.

  • Version: a release of a software item. Each version has its own SBOM, findings and lifecycle status (Pre-release, Released, End of support, End of life).

  • Components: the packages and libraries inside a version, imported from your SBOM or added manually.

  • Findings: known vulnerabilities matched to your components, ready for triage.

What happens when you upload an SBOM

  1. The file is parsed and components are imported. Standard SBOM formats (CycloneDX and SPDX) and CSV are detected automatically.

  2. Metadata is inherited from the previous version of the same software item, so curated data carries forward.

  3. Components are checked against FDA submission rules.

  4. Components are scanned against the major vulnerability databases: GitHub Security Advisories, the US National Vulnerability Database (NVD) and OSV.dev. Findings are also flagged when a vulnerability is being actively exploited in the wild (CISA's KEV catalogue) and scored for how likely exploitation is (EPSS).

By the time the import shows Complete, your findings are ready to triage. Versions are also re-scanned automatically on a schedule, so new advisories affecting released software surface without you re-uploading anything.

From there to a submission

Each version page is a workbench titled "Get this version submission-ready", with three steps: fill missing component data with enrichment, triage vulnerabilities and record decisions, then release the version and download your submission package. The package contains six PDF exhibits, plus machine-readable SBOM and VEX exports (VEX is the standard format for stating each vulnerability's status).

Next: Set up your organisation and first project.

Did this answer your question?