Lion Cipher Lab
Scan an SBOM for known vulnerabilities with Grype and gate on fixable severity
- Cloud Security
- Intermediate
- ~40 min
- Free · no account required
Why it matters
A Software Bill of Materials (SBOM) is a durable, machine-readable list of everything inside an artifact. Once you have it, you can re-check it against today's vulnerability data without rebuilding, and hand it to whoever consumes your software. Scanning the SBOM instead of re-scanning the image every time is how mature supply-chain security works: the inventory is the source of truth, and the vulnerability feed moves underneath it. Learn to generate one, scan it, and gate a pipeline on the result, and you can block a known-vulnerable build before it ships.
What you'll learn
- SBOM-driven vulnerability scanning
- Grype
- Syft
- CI security gating
- vulnerability triage
Steps in this lab
- The idea: scan the inventory, not the image
- Pull a deliberately-old image so there's something to find
- Generate the SBOM with Syft
- Scan the SBOM with Grype and read the table
- Gate a pipeline: make Grype fail the build
- Silence a false positive with an ignore rule
- The judgment: SBOM-first, Grype vs Trivy, and what a scanner can't see