# SBOM Shield: daily vendor SBOM monitoring with email alerts

$99/month, cancel anytime. The free browser checker tells you what a vendor's SBOM contains today; the Shield tells you what changed tomorrow. Every component in your roster (up to 50 vendor SBOMs) is re-matched against Google's OSV database daily, and the day one of your components lands in a new advisory, the alert email arrives: vendor, component, advisory ID and CVE alias, severity where published.

How it works:
1. Subscribe with the alert email. The manage link arrives by email; it is the only credential (no passwords by design).
2. Paste each vendor's CycloneDX or SPDX JSON on the manage page. The NTIA element check and the first OSV match run at upload.
3. Every day the engine re-checks every component against OSV. New advisory in your roster: one email. Nothing new: silence.

Honest boundaries: the Shield matches SBOM metadata against public vulnerability data. It does not scan binaries, reverse engineer code, or certify vendors, and an alert is a signal to check, not a legal conclusion. Components without a purl cannot be matched by anyone; the upload says which. The free checker stays free forever: https://vendorquals.com/tools/sbom-checker

Who this is for: the buyer holding 3 to 50 vendor SBOMs with no ops team to self-host an open-source platform and no enterprise appetite for a demo-gated tool. FDA section 524B and the EU Cyber Resilience Act put dates on SBOM obligations; the standing watch is the piece the one-shot checkers cannot give you.

Source: https://vendorquals.com/sbom-shield. This page is also served as HTML at https://vendorquals.com/sbom-shield.