2.06Security engineering
Supply Chain Security & SBOM
Software supply-chain assessment covering dependencies, SBOMs, build and release integrity, artefact signing, provenance and third-party assurance.
Modern software depends on open-source components, build systems, registries and external services. A weakness or compromise in any of these layers can affect every downstream release. We assess dependencies, build and release controls, signing, provenance and supplier access.
We help generate and maintain machine-readable SBOMs in formats such as CycloneDX or SPDX and establish a process for linking newly disclosed vulnerabilities to affected products and versions. This supports vulnerability management and the technical-documentation expectations of the EU Cyber Resilience Act.
Build-pipeline hardening can include protected branches, isolated runners, least-privilege credentials, artefact signing and provenance controls aligned with frameworks such as SLSA. Supplier assurance is adapted to the importance and access of each third party.
How it works
- 01
Inventory & SBOM
Build a complete software bill of materials across apps, dependencies and build artifacts.
- 02
Risk analysis
Assess dependencies, build integrity and vendor exposure for exploitable components.
- 03
Pipeline hardening
Strengthen CI/CD integrity, provenance and signing against tampering.
- 04
Compliance & monitoring
Align to CRA obligations and stand up continuous SBOM and CVE monitoring.
Packages
- Essential
- SBOM generation and dependency-risk assessment for a key product.
- ComprehensivePopular
- Full supply-chain review with pipeline hardening and CRA readiness.
- Enterprise
- Continuous SBOM monitoring and supply-chain assurance programme.
Supported by our own threat-intelligence platform
Your dependencies and vendors are exactly what our platform tracks. Work with us and that monitoring is included – not a separate tool to buy.
OffSeq Threat Radar
Tracks newly disclosed vulnerabilities affecting the components and vendors in your technology environment.
Explorethreat-finder
Identifies known vulnerable components observed in running services and prioritises them using exposure context.
ExploreOffSeq Breach
Flags leaked credentials at your third parties before they become your breach.
Explore
What clients in your sector say
From organisations in the same sector.
Manufacturing“Their structured methodology, clear communication, and actionable insights directly contributed to increased system reliability, scalability, and resilience.”
Oskars Podziņš
Head of Information Security · Printful
IT services“What stands out is their practical approach – no fluff, just clear findings and actionable recommendations.”
Viktors Trifanovs
CISO · TestDevLab
Manufacturing“They found holes me and my IT team were astonished to hear about. They worked from the heart and in high quality.”
Andzejs Stenclavs
Kinetics
All services
Scope a test
support@offseq.com+371 2256 5353
Direct access to a senior specialist · Reply within 24 hours · NDA available on request