An explainable sbom-driven framework for software supply chain risk assessment and vulnerability prioritization

Modern software applications depend on open-source libraries, transitive dependencies, build tools, and third-party components. Although software reuse improves development efficiency, it creates supply-chain risks because vulnerabilities in one component can affect numerous downstream applications. A Software Bill of Materials (SBOM) provides a machine-readable inventory of software components, yet an SBOM alone does not guarantee inventory completeness, correct component identification, or effective vulnerability prioritization. This paper proposes an explainable SBOM-driven framework combining inventory-quality checks, component normalization, public vulnerability intelligence, and transparent risk ranking. SBOMs will be generated for selected open-source projects and compared with available manifests or lockfiles. Component records will be enriched using CVE/NVD and OSV data, CVSS severity, EPSS exploitation probability, CISA Known Exploited Vulnerabilities (KEV) status, and dependency context. The proposed score will be compared with CVSS-only, EPSS-only, and KEV-first baselines. Since experiments have not yet been completed, this paper presents a research design rather than measured performance claims. The intended contribution is a reproducible methodology that makes ranking evidence, missing metadata, and uncertainty visible