Fetching SBOM, querying OSV, computing risk — usually under 15 seconds.