**_We Raised $20 Million_** _/_ [_Read the Announcement_](https://raven.io/blog/%20raven-raises-20m-seed-round-to-protect-applications-at-runtime-even-without-signatures-or-cves)

# VEX

Enrich your SBOMs and AIBOMs with precise exploitability indications powered by Raven. SBOMs and AIBOMs by themselves are records of the hundreds of open source libraries which build up an application. VEX or Vulnerability Exploitability eXchange plays a crucial role in enhancing the usefulness of SBOMs by providing context around known vulnerabilities. While SBOMs and AIBOMs list all components in a software product, they don't indicate whether a listed vulnerability actually affects the software. VEX fills this gap by specifying whether a given vulnerability is exploitable or not in the context of a specific product helping you prioritize risk, and avoid unnecessary patching by making informed decisions about their security posture.

Raven adds VEX to its SBOMs and AIBOMs based on its function level runtime reachability. While we may be listing hundreds of libraries containing vulnerabilities in the BOM for an application, usually only a couple of them are actually vulnerable. Raven determines the execution of libraries with vulnerabilities and within them, the execution of the specific functions which makes them vulnerable, all in real time, to calculate a VEX record per vulnerable library in your application.

## Prioritized, Context-Aware Compliance

### Cut Through the Noise

Raven identifies which vulnerabilities are actually exploitable at runtime, reducing false positives and helping teams focus on real risks.

### Prioritize with Precision

By analyzing function-level execution, Raven’s VEX shows exactly which vulnerabilities matter.

### Streamline Remediation

Raven’s VEX insights help avoid unnecessary fixes, align security with dev priorities, and speed up response without slowing releases.

[Learn About Runtime SCA](https://raven.io/runtime-sca)

## Check out more Use Cases

### Eliminate the Exposure Window

[Learn More](https://raven.io/use-cases/vex#)

### CVSS 10 With No Risk

[Learn More](https://raven.io/use-cases/vex#)

### Stop Application Attacks

[Learn More](https://raven.io/use-cases/vex#)

### Delay a Fix and Stay Protected

[Learn More](https://raven.io/use-cases/delay-a-fix-and-stay-protected)

### Protect AI and LLM Models

[Learn More](https://raven.io/use-cases/protect-ai-and-llm-models)

## Blog

### Security

The malicious Axios releases weren't a smash-and-grab. They were a multi-stage malware campaign using npm's install path as a deployment mechanism. Here's what that means for defenders.

[Read more](https://raven.io/blog/axios-wasnt-just-compromised-it-was-weaponized)

### Company News

Raven secures $20M to stop application exploits at runtime—even without CVEs or signatures—bringing real-time protection inside the application layer.

[Read more](https://raven.io/blog/raven-raises-20m-seed-round-to-protect-applications-at-runtime-even-without-signatures-or-cves)

### Security

A deep analysis of React2Shell (CVE-2025-55182) RCE in RSC Flight protocol—and why WAF rule patches fail to protect modern React and Next.js apps.

[Read more](https://raven.io/blog/the-deepest-research-on-the-react2shell-cve-2025-55182-and-why-your-waf-rule-patch-leaves-you-exposed)