What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.

Courses

Auditing Software Bills of Materials (SBOMs) and Vulnerability Exploitability eXchange (VEX) Statements

IntermediateFree5 modules · 15 lessons · ~2 min

About this course

An auditor's method for testing SBOMs and VEX statements as management assertions rather than accepting them as documents. You will reconcile SPDX and CycloneDX inventories to builds, lockfiles and registries, test the justification behind every not_affected claim, and trace SBOM, VEX and vulnerability findings to each other and to the audit trail. The course closes with red flags, common audit failures and how to write the finding.

What you'll learn

The SBOM as a Set of Assertions

What an SBOM Claims and What It Cannot
NTIA Minimum Elements and EO 14028 as an Audit Checklist
Reading SPDX for Audit: Fields That Matter and How to Verify Them
Reading CycloneDX for Audit

Testing SBOM Assertions

Testing Completeness: Reconciling the SBOM to the Build
Testing Accuracy and Existence: Identifiers, Versions and Hashes
Testing Cutoff and Identity: One SBOM per Build, Timestamps and Immutability
SBOM Quality Scores: Reading a Score Without Trusting It

The VEX as an Assertion

What a VEX Statement Claims: Statuses, Roles and Formats
Justifications and Evidence: Testing a not_affected Claim
VEX Lifecycle, Timeliness and Revision

Cross-Artefact Reconciliation

Reconciling SBOM, VEX and the Vulnerability List
Supplier SBOMs in TPRM: Auditing the Consumer's Controls

Reporting

Red Flags and Common Audit Failures
Claims to Evidence, Real Artefacts and Writing the Finding

01The SBOM as a Set of Assertions4 lessons

What an SBOM Claims and What It Cannot
NTIA Minimum Elements and EO 14028 as an Audit Checklist
Reading SPDX for Audit: Fields That Matter and How to Verify Them

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.