That is literally how the CycloneDX SBOM packages work, well, after the fact and after the disclosure process.