Startup-SBOM statically analyses a Linux root filesystem, container or image and answers three questions most SBOM tools can’t:

1. Vulnerability → threat. Not “openssl has 14 CVEs”, but “an unauthenticated remote attacker who can reach TCP/22 could exploit CVE-2024-6387 in openssh-server (sshd, ssh.service, enabled at boot, runs as root) to execute code as root — EPSS 0.94, known exploited. Fix: upgrade to 1:9.2p1-2+deb12u3.” Every finding is placed in context: is it reachable at boot, through which service, linked by which binary, what triggers it (boot, socket, timer, cron, D-Bus, udev device event, setuid binary, kernel) and who can fire that trigger, as which user, network-exposed, mitigated by which systemd hardening, mapped to MITRE ATT&CK, with a CISA SSVC decision (Track / Track* / Attend / Act).
2. Chained attacks. A privilege-state attack graph (remote → local:<user> → root → container escape → persistence) built from vulnerabilities and misconfigurations (setuid/capability binaries, privileged containers, mounted Docker socket, kernel CVEs, writable units), pruned by hardening and ranked by likelihood × impact. 3.…