diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index cb2d070a..665cf2ee 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -11,6 +11,18 @@ Release notes
   vulnerability data is available.
   https://github.com/aboutcode-org/dejacode/issues/98
 
+- Introduce a new VulnerabilityAnalysis model based on CycloneDX spec:
+  https://cyclonedx.org/docs/1.6/json/#vulnerabilities_items_analysis
+  A VulnerabilityAnalysis is always assigned to a Vulnerability object and a
+  ProductPackage relation.
+  The values for a VulnerabilityAnalysis are display in the Product "Vulnerabilities"
+  tab.
+  A "Edit" button can be used to open a form in a model to provided analysis data.
+  Those new VEX related columns can be sorted and filtered.
+  The VulnerabilityAnalysis data is exported in the VEX (only) and SBOM+VEX (combined)
+  outputs.
+  https://github.com/aboutcode-org/dejacode/issues/98
+
 ### Version 5.2.1
 
 - Fix the models documentation navigation.
diff --git a/component_catalog/filters.py b/component_catalog/filters.py
index 83294143..58425811 100644
--- a/component_catalog/filters.py
+++ b/component_catalog/filters.py
@@ -49,6 +49,10 @@ class ComponentFilterSet(DataspacedFilterSet):
         "primary_language",
         "usage_policy",
     ]
+    dropdown_fields = [
+        "type",
+        "usage_policy",
+    ]
     q = MatchOrderedSearchFilter(
         label=_("Search"),
         match_order_fields=["name"],
@@ -122,9 +126,7 @@ class Meta:
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         self.filters["usage_policy"].extra["to_field_name"] = "label"
-        self.filters["usage_policy"].extra["widget"] = DropDownRightWidget()
         self.filters["type"].extra["to_field_name"] = "label"
-        self.filters["type"].extra["widget"] = DropDownRightWidget()
 
     @cached_property
     def sort_value(self):
@@ -180,6 +182,7 @@ def filter(self, qs, value):
 
 
 class PackageFilterSet(DataspacedFilterSet):
+    dropdown_fields = ["usage_policy"]
     q = PackageSearchFilter(
         label=_("Search"),
         match_order_fields=[
@@ -262,7 +265,6 @@ class Meta:
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         self.filters["usage_policy"].extra["to_field_name"] = "label"
-        self.filters["usage_policy"].extra["widget"] = DropDownRightWidget()
 
     @cached_property
     def sort_value(self):
diff --git a/dejacode/static/css/dejacode_bootstrap.css b/dejacode/static/css/dejacode_bootstrap.css
index 42d1c652..ac1656a6 100644
--- a/dejacode/static/css/dejacode_bootstrap.css
+++ b/dejacode/static/css/dejacode_bootstrap.css
@@ -92,6 +92,7 @@ table.text-break thead {
 .bg-warning-orange {
   background-color: var(--bs-orange);
 }
+
 /* -- Dark there fixes -- */
 [data-bs-theme=dark] .btn-outline-dark {
   --bs-btn-color: var(--bs-tertiary-color);
@@ -390,17 +391,26 @@ table.vulnerabilities-table .column-summary {
   min-width: 300px;
 }
 #tab_vulnerabilities .column-exploitability {
-  width: 150px;
+  width: 155px;
 }
 #tab_vulnerabilities .column-weighted_severity {
-  width: 115px;
+  width: 120px;
 }
 #tab_vulnerabilities .column-risk_score {
-  width: 95px;
+  width: 90px;
 }
 #tab_vulnerabilities .column-summary {
   width: 300px;
 }
+#tab_vulnerabilities .column-vulnerability_analyses__state {
+  min-width: 105px;
+}
+#tab_vulnerabilities .column-vulnerability_analyses__justification {
+  min-width: 130px;
+}
+#tab_vulnerabilities .column-vulnerability_analyses__responses {
+  min-width: 120px;
+}
 
 /* -- Dependency tab -- */
 #tab_dependencies .column-for_package {
@@ -540,6 +550,10 @@ table.purldb-table .column-license_expression {
   vertical-align: middle;
 }
 
+#vulnerability-analysis-form fieldset legend {
+  font-size: 1rem;
+}
+
 /* -- Object form (add/edit) -- */
 .datepicker {
   width: 130px;
diff --git a/dje/filters.py b/dje/filters.py
index 0aab8a31..05bbd7a9 100644
--- a/dje/filters.py
+++ b/dje/filters.py
@@ -43,6 +43,7 @@
 from dje.utils import extract_name_version
 from dje.utils import get_uuids_list_sorted
 from dje.utils import remove_field_from_query_dict
+from dje.widgets import DropDownRightWidget
 
 IS_FILTER_LOOKUP_VAR = "_filter_lookup"
 
@@ -80,6 +81,7 @@ def get_filters_breadcrumbs(self):
 
 class DataspacedFilterSet(FilterSetUtilsMixin, django_filters.FilterSet):
     related_only = []
+    dropdown_fields = []
 
     def __init__(self, *args, **kwargs):
         try:
@@ -90,6 +92,7 @@ def __init__(self, *args, **kwargs):
         self.dynamic_qs = kwargs.pop("dynamic_qs", True)
         self.parent_qs_cache = {}
         self.anchor = kwargs.pop("anchor", None)
+        self.dropdown_fields = kwargs.pop("dropdown_fields", []) or self.dropdown_fields
 
         super().__init__(*args, **kwargs)
 
@@ -106,6 +109,9 @@ def __init__(self, *args, **kwargs):
             model_name = self._meta.model._meta.model_name
             usage_policy.queryset = usage_policy.queryset.filter(content_type__model=model_name)
 
+        for field_name in self.dropdown_fields:
+            self.filters[field_name].extra["widget"] = DropDownRightWidget(anchor=self.anchor)
+
     def apply_related_only(self, field_name, filter_):
         """
         Limit the filter choices to the values used on the parent queryset.
diff --git a/dje/outputs.py b/dje/outputs.py
index 41be7b0a..29eefa98 100644
--- a/dje/outputs.py
+++ b/dje/outputs.py
@@ -132,10 +132,20 @@ def get_cyclonedx_bom(instance, user, include_components=True, include_vex=False
 
     if include_vex:
         vulnerability_qs = instance.get_vulnerability_qs(prefetch_related_packages=True)
-        vulnerabilities = [
-            vulnerability.as_cyclonedx(affected_instances=vulnerability.affected_packages.all())
-            for vulnerability in vulnerability_qs
-        ]
+        vulnerabilities = []
+        for vulnerability in vulnerability_qs:
+            analysis = None
+            vulnerability_analyses = vulnerability.vulnerability_analyses.all()
+            if len(vulnerability_analyses) == 1:
+                analysis = vulnerability_analyses[0]
+
+            vulnerabilities.append(
+                vulnerability.as_cyclonedx(
+                    affected_instances=vulnerability.affected_packages.all(),
+                    analysis=analysis,
+                )
+            )
+
         bom.vulnerabilities = vulnerabilities
 
     return bom
diff --git a/dje/templates/includes/object_list_table_header.html b/dje/templates/includes/object_list_table_header.html
index f28dedf7..d6d4f5ea 100644
--- a/dje/templates/includes/object_list_table_header.html
+++ b/dje/templates/includes/object_list_table_header.html
@@ -36,5 +36,8 @@
         {% endif %}
       </th>
     {% endfor %}
+    {% if include_actions %}
+      <th class="column-action" scope="col"></th>
+    {% endif %}
   </tr>
 </thead>
\ No newline at end of file
diff --git a/dje/tests/test_outputs.py b/dje/tests/test_outputs.py
index 93008442..1848cbd5 100644
--- a/dje/tests/test_outputs.py
+++ b/dje/tests/test_outputs.py
@@ -6,6 +6,8 @@
 # See https://aboutcode.org for more information about AboutCode FOSS projects.
 #
 
+import json
+
 from django.test import TestCase
 
 from cyclonedx.model import bom as cyclonedx_bom
@@ -18,6 +20,7 @@
 from dje.tests import create_user
 from product_portfolio.models import Product
 from product_portfolio.tests import make_product_package
+from vulnerabilities.models import VulnerabilityAnalysis
 from vulnerabilities.tests import make_vulnerability
 
 
@@ -97,7 +100,7 @@ def test_outputs_get_cyclonedx_bom(self):
 
     def test_outputs_get_cyclonedx_bom_include_vex(self):
         package_in_product = make_package(self.dataspace, package_url="pkg:type/name")
-        make_product_package(self.product1, package_in_product)
+        product_package1 = make_product_package(self.product1, package_in_product)
         package_not_in_product = make_package(self.dataspace)
         vulnerability1 = make_vulnerability(
             self.dataspace, affecting=[package_in_product, package_not_in_product]
@@ -112,6 +115,24 @@ def test_outputs_get_cyclonedx_bom_include_vex(self):
         self.assertIsInstance(bom, cyclonedx_bom.Bom)
         self.assertEqual(1, len(bom.vulnerabilities))
         self.assertEqual(vulnerability1.vulnerability_id, bom.vulnerabilities[0].id)
+        self.assertIsNone(bom.vulnerabilities[0].analysis)
+
+        VulnerabilityAnalysis.objects.create(
+            product_package=product_package1,
+            vulnerability=vulnerability1,
+            state=VulnerabilityAnalysis.State.RESOLVED,
+            justification=VulnerabilityAnalysis.Justification.CODE_NOT_PRESENT,
+            detail="detail",
+            dataspace=self.dataspace,
+        )
+        bom = outputs.get_cyclonedx_bom(
+            instance=self.product1,
+            user=self.super_user,
+            include_vex=True,
+        )
+        analysis = bom.vulnerabilities[0].analysis
+        expected = {"detail": "detail", "justification": "code_not_present", "state": "resolved"}
+        self.assertEqual(expected, json.loads(analysis.as_json()))
 
     def test_outputs_get_cyclonedx_bom_json(self):
         bom = outputs.get_cyclonedx_bom(instance=self.product1, user=self.super_user)
diff --git a/license_library/filters.py b/license_library/filters.py
index e693ba54..18f50a21 100644
--- a/license_library/filters.py
+++ b/license_library/filters.py
@@ -29,6 +29,10 @@ class LicenseFilterSet(DataspacedFilterSet):
         "license_profile",
         "usage_policy",
     ]
+    dropdown_fields = [
+        "category__license_type",
+        "usage_policy",
+    ]
     q = MatchOrderedSearchFilter(
         label=_("Search"),
         match_order_fields=["short_name", "key", "name"],
@@ -101,6 +105,3 @@ def __init__(self, *args, **kwargs):
         self.filters["usage_policy"].extra["to_field_name"] = "label"
         self.filters["usage_policy"].label = _("Policy")
         self.filters["category__license_type"].label = _("Type")
-
-        for filter_name in ["category__license_type", "usage_policy"]:
-            self.filters[filter_name].extra["widget"] = DropDownRightWidget()
diff --git a/product_portfolio/models.py b/product_portfolio/models.py
index 54c3582e..ee8db99f 100644
--- a/product_portfolio/models.py
+++ b/product_portfolio/models.py
@@ -43,6 +43,7 @@
 from dje.validators import validate_version
 from vulnerabilities.fetch import fetch_for_packages
 from vulnerabilities.models import Vulnerability
+from vulnerabilities.models import VulnerabilityAnalysis
 
 RELATION_LICENSE_EXPRESSION_HELP_TEXT = _(
     "The License Expression assigned to a DejaCode Product Package or Product "
@@ -335,6 +336,10 @@ def all_packages(self):
             models.Q(id__in=self.packages.all()) | models.Q(component__in=self.components.all())
         ).distinct()
 
+    @cached_property
+    def vulnerability_count(self):
+        return self.get_vulnerability_qs().count()
+
     def get_merged_descendant_ids(self):
         """
         Return a list of Component ids collected on the Product descendants:
@@ -514,13 +519,21 @@ def fetch_vulnerabilities(self):
 
     def get_vulnerability_qs(self, prefetch_related_packages=False):
         """Return a QuerySet of all Vulnerability instances related to this product"""
-        qs = Vulnerability.objects.filter(affected_packages__in=self.packages.all())
+        vulnerability_qs = Vulnerability.objects.filter(
+            affected_packages__in=self.packages.all()
+        ).distinct()
 
         if prefetch_related_packages:
             package_qs = Package.objects.filter(product=self).only_rendering_fields()
-            qs = qs.prefetch_related(models.Prefetch("affected_packages", package_qs))
+            analysis_qs = VulnerabilityAnalysis.objects.filter(product=self).select_related(
+                "package"
+            )
+            vulnerability_qs = vulnerability_qs.prefetch_related(
+                models.Prefetch("affected_packages", package_qs),
+                models.Prefetch("vulnerability_analyses", analysis_qs),
+            )
 
-        return qs
+        return vulnerability_qs
 
 
 class ProductRelationStatus(BaseStatusMixin, DataspacedModel):
diff --git a/product_portfolio/templates/product_portfolio/modals/vulnerability_analysis_modal.html b/product_portfolio/templates/product_portfolio/modals/vulnerability_analysis_modal.html
new file mode 100644
index 00000000..fae63967
--- /dev/null
+++ b/product_portfolio/templates/product_portfolio/modals/vulnerability_analysis_modal.html
@@ -0,0 +1,27 @@
+{% load crispy_forms_tags %}
+<div id="vulnerability-analysis-modal" class="modal modal-lg" tabindex="-1" role="dialog">
+  <div class="modal-dialog" role="document">
+    <div class="modal-content">
+      <div class="modal-header">
+        <div class="modal-title">
+          <h5>
+            Vulnerability analysis:
+            <strong id="analysis-vulnerability-id"></strong>
+          </h5>
+          <div>
+            Package: <strong id="analysis-package-identifier"></strong>
+          </div>
+        </div>
+        <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+      </div>
+      <form autocomplete="off" method="post" id="vulnerability-analysis-form">
+        <div class="modal-body bg-body-tertiary" id="vulnerability-analysis-modal-body">
+        </div>
+        <div class="modal-footer">
+          <input type="button" name="close" value="Close" class="btn btn-secondary" data-bs-dismiss="modal">
+          <input type="submit" id="submit-vulnerability-analysis-form" value="Submit" class="btn btn-primary btn-success">
+        </div>
+      </form>
+    </div>
+  </div>
+</div>
\ No newline at end of file
diff --git a/product_portfolio/templates/product_portfolio/product_details.html b/product_portfolio/templates/product_portfolio/product_details.html
index 047b8695..c4b26359 100644
--- a/product_portfolio/templates/product_portfolio/product_details.html
+++ b/product_portfolio/templates/product_portfolio/product_details.html
@@ -119,6 +119,9 @@
   {% if tabsets.Imports %}
     {% include 'product_portfolio/includes/scancode_project_status_modal.html' %}
   {% endif %}
+  {% if request.user.dataspace.enable_vulnerablecodedb_access and product.vulnerability_count %}
+    {% include 'product_portfolio/modals/vulnerability_analysis_modal.html' %}
+  {% endif %}
 {% endblock %}
 
 {% block extrastyle %}
@@ -232,6 +235,63 @@
     </script>
   {% endif %}
 
+  {% if request.user.dataspace.enable_vulnerablecodedb_access and product.vulnerability_count %}
+    <script>
+      $(document).ready(function () {
+        let vulnerability_modal = $('#vulnerability-analysis-modal');
+        vulnerability_modal.on('show.bs.modal', function (event) {
+          let modal_body = $('#vulnerability-analysis-modal-body');
+          modal_body.html('');  // Reset the modal content
+
+          let button = $(event.relatedTarget); // Button that triggered the modal
+          // Extract info from data-* attributes
+          let edit_url = button.data('edit-url');
+          let vulnerability_id = button.data('vulnerability-id');
+          let package_identifier = button.data('package-identifier');
+
+          $('#submit-vulnerability-analysis-form').data('edit-url', edit_url);
+          $('#vulnerability-analysis-modal #analysis-vulnerability-id').text(vulnerability_id);
+          $('#vulnerability-analysis-modal #analysis-package-identifier').text(package_identifier);
+
+          $.ajax({
+            url: edit_url,
+            success: function(data) {
+              modal_body.html(data);
+            },
+            error: function() {
+              modal_body.html('Error.');
+            }
+          });
+        });
+
+        $('#submit-vulnerability-analysis-form').on('click', function(event){
+          event.preventDefault();
+          let modal_body = $('#vulnerability-analysis-modal-body');
+          let edit_url = $('#submit-vulnerability-analysis-form').data('edit-url');
+
+          $.ajax({
+            url: edit_url,
+            type: 'POST',
+            headers: {'X-CSRFToken': csrftoken},
+            data: $('#vulnerability-analysis-form').serialize(),
+            success: function(data) {
+              if (data['success']) {
+                location.reload();
+                return false;
+              }
+              modal_body.html(data);
+              edit_modal.animate({scrollTop: 0});
+            },
+            error: function(){
+              modal_body.html('Error.');
+            }
+          });
+        });
+
+      });
+    </script>
+  {% endif %}
+
   {% if purldb_enabled %}
     <script>
       document.addEventListener('DOMContentLoaded', function () {
diff --git a/product_portfolio/templates/product_portfolio/tabs/tab_vulnerabilities.html b/product_portfolio/templates/product_portfolio/tabs/tab_vulnerabilities.html
index 39633391..2c858781 100644
--- a/product_portfolio/templates/product_portfolio/tabs/tab_vulnerabilities.html
+++ b/product_portfolio/templates/product_portfolio/tabs/tab_vulnerabilities.html
@@ -1,11 +1,11 @@
 {% load i18n %}
 {% include 'tabs/pagination.html' %}
-<table class="table table-bordered table-hover table-md text-break">
-  {% include 'includes/object_list_table_header.html' with filter=filterset %}
+<table class="table table-bordered table-md text-break">
+  {% include 'includes/object_list_table_header.html' with filter=filterset include_actions=True %}
   <tbody>
     {% for vulnerability in page_obj.object_list %}
       <tr>
-        <td>
+        <td rowspan="{{ vulnerability.affected_packages_count }}">
           <strong>
             {% if vulnerability.resource_url %}
               <a href="{{ vulnerability.resource_url }}" target="_blank">
@@ -15,42 +15,73 @@
             {% else %}
               {{ vulnerability.vulnerability_id }}
             {% endif %}
+            {% if vulnerability.summary %}
+              <span class="float-end" data-bs-toggle="popover" data-bs-placement="right" data-bs-trigger="hover focus" data-bs-html="true" data-bs-content="{{ vulnerability.summary|linebreaksbr }}">
+                <i class="fa-solid fa-circle-info"></i>
+              </span>
+            {% endif %}
           </strong>
-          <div class="mt-2">
-            {% include 'component_catalog/includes/vulnerability_aliases.html' with aliases=vulnerability.aliases only %}
-          </div>
-        </td>
-        <td>
-          <ul class="list-unstyled mb-0">
-            {% for package in vulnerability.affected_packages.all %}
-              <li>
-                <a href="{{ package.get_absolute_url }}#vulnerabilities" target="_blank">{{ package }}</a>
-                {% include 'vulnerabilities/includes/risk_score_badge.html' with risk_score=package.risk_score label='risk' only %}
-              </li>
-            {% endfor %}
-          </ul>
+          {% if vulnerability.aliases %}
+            <div class="mt-2">
+              {% include 'component_catalog/includes/vulnerability_aliases.html' with aliases=vulnerability.aliases only %}
+            </div>
+          {% endif %}
         </td>
-        <td>
+        <td rowspan="{{ vulnerability.affected_packages_count }}">
           {% include 'vulnerabilities/includes/exploitability.html' with instance=vulnerability only %}
         </td>
-        <td>
+        <td rowspan="{{ vulnerability.affected_packages_count }}">
           {{ vulnerability.weighted_severity|default_if_none:"" }}
         </td>
-        <td class="fs-110pct">
+        <td rowspan="{{ vulnerability.affected_packages_count }}" class="fs-110pct">
           {% include 'vulnerabilities/includes/risk_score_badge.html' with risk_score=vulnerability.risk_score only %}
         </td>
-        <td>
-          {% if vulnerability.summary %}
-            {% if vulnerability.summary|length > 120 %}
-              <details>
-                <summary>{{ vulnerability.summary|slice:":120" }}...</summary>
-                {{ vulnerability.summary|slice:"120:" }}
-              </details>
-            {% else %}
-              {{ vulnerability.summary }}
+        {% for package in vulnerability.affected_packages.all %}
+          {% if not forloop.first %}<tr>{% endif %}
+          <td>
+            <ul class="list-unstyled mb-0">
+              <li>
+                <a href="{{ package.get_absolute_url }}#vulnerabilities" target="_blank">{{ package }}</a>
+                {% include 'vulnerabilities/includes/risk_score_badge.html' with risk_score=package.risk_score label='risk' only %}
+              </li>
+            </ul>
+          </td>
+          <td>
+            {% if package.vulnerability_analysis %}
+              {% if package.vulnerability_analysis.state %}
+                <strong>{{ package.vulnerability_analysis.get_state_display }}</strong>
+              {% endif %}
+              {% if package.vulnerability_analysis.detail %}
+                <span data-bs-toggle="popover" data-bs-placement="right" data-bs-trigger="hover focus" data-bs-html="true" data-bs-content="{{ package.vulnerability_analysis.detail|linebreaksbr }}">
+                  <i class="fa-solid fa-circle-info"></i>
+                </span>
+              {% endif %}
             {% endif %}
-          {% endif %}
-        </td>
+          </td>
+          <td>
+            {% if package.vulnerability_analysis.justification %}
+              {{ package.vulnerability_analysis.get_justification_display }}
+            {% endif %}
+          </td>
+          <td>
+            {% if package.vulnerability_analysis.responses %}
+              {{ package.vulnerability_analysis.responses|join:"<br>" }}
+            {% endif %}
+          </td>
+          <td class="p-1">
+            <span data-bs-toggle="modal"
+                  data-bs-target="#vulnerability-analysis-modal"
+                  data-vulnerability-id="{{ vulnerability.vulnerability_id }}"
+                  data-package-identifier="{{ package.identifier }}"
+                  data-edit-url="{% url 'product_portfolio:vulnerability_analysis_form' product.uuid vulnerability.vulnerability_id package.uuid %}"
+            >
+              <button type="button" data-bs-toggle="tooltip" title="Edit" class="btn btn-link p-0" aria-label="Edit">
+                <i class="far fa-edit fa-sm"></i>
+              </button>
+            </span>
+          </td>
+          {% if not forloop.first %}</tr>{% endif %}
+        {% endfor %}
       </tr>
     {% empty %}
       <tr>
diff --git a/product_portfolio/tests/test_models.py b/product_portfolio/tests/test_models.py
index f93085d3..dabf44da 100644
--- a/product_portfolio/tests/test_models.py
+++ b/product_portfolio/tests/test_models.py
@@ -18,6 +18,7 @@
 from component_catalog.models import Component
 from component_catalog.models import ComponentAssignedPackage
 from component_catalog.models import Package
+from component_catalog.tests import make_package
 from dje.models import Dataspace
 from dje.models import History
 from dje.tests import add_perms
@@ -40,6 +41,7 @@
 from product_portfolio.models import ProductStatus
 from product_portfolio.models import ScanCodeProject
 from product_portfolio.tests import make_product_package
+from vulnerabilities.tests import make_vulnerability
 from workflow.models import RequestTemplate
 
 
@@ -498,6 +500,35 @@ def test_product_model_improve_packages_from_purldb(self, mock_update_from_purld
         self.assertEqual(2, len(updated_packages))
         self.assertEqual(2, mock_update_from_purldb.call_count)
 
+    def test_product_model_get_vulnerability_qs(self):
+        package1 = make_package(self.dataspace)
+        package2 = make_package(self.dataspace)
+        vulnerability1 = make_vulnerability(self.dataspace, affecting=[package1, package2])
+        vulnerability2 = make_vulnerability(self.dataspace, affecting=[package1, package2])
+        make_product_package(self.product1, package=package1)
+        make_product_package(self.product1, package=package2)
+
+        queryset = self.product1.get_vulnerability_qs()
+        # Makeing sure the distinct() is properly applied
+        self.assertEqual(2, len(queryset))
+        self.assertIn(vulnerability1, queryset)
+        self.assertIn(vulnerability2, queryset)
+
+    def test_product_model_vulnerability_count_property(self):
+        self.assertEqual(0, self.product1.vulnerability_count)
+
+        package1 = make_package(self.dataspace)
+        package2 = make_package(self.dataspace)
+        make_vulnerability(self.dataspace, affecting=[package1, package2])
+        make_vulnerability(self.dataspace, affecting=[package1, package2])
+        make_product_package(self.product1, package=package1)
+        make_product_package(self.product1, package=package2)
+
+        # Still 0 on the instance as it is a cached_property
+        self.assertEqual(0, self.product1.vulnerability_count)
+        self.product1 = Product.unsecured_objects.get(pk=self.product1.pk)
+        self.assertEqual(2, self.product1.vulnerability_count)
+
     def test_productcomponent_model_license_expression_handle_assigned_licenses(self):
         p1 = ProductComponent.objects.create(
             product=self.product1, name="p1", dataspace=self.dataspace
diff --git a/product_portfolio/tests/test_views.py b/product_portfolio/tests/test_views.py
index 7c2e8fcc..aeeb9596 100644
--- a/product_portfolio/tests/test_views.py
+++ b/product_portfolio/tests/test_views.py
@@ -59,6 +59,7 @@
 from product_portfolio.tests import make_product
 from product_portfolio.tests import make_product_package
 from product_portfolio.views import ManageComponentGridView
+from vulnerabilities.models import VulnerabilityAnalysis
 from vulnerabilities.tests import make_vulnerability
 from workflow.models import Request
 from workflow.models import RequestTemplate
@@ -274,7 +275,7 @@ def test_product_portfolio_detail_view_tab_dependency_view(self):
             response = self.client.get(url)
         self.assertContains(response, "4 results")
 
-    def test_product_portfolio_detail_view_tab_vulnerability_view(self):
+    def test_product_portfolio_detail_view_tab_vulnerability_queryset(self):
         self.client.login(username="nexb_user", password="secret")
         url = self.product1.get_url("tab_vulnerabilities")
 
@@ -296,7 +297,7 @@ def test_product_portfolio_detail_view_tab_vulnerability_view(self):
             response = self.client.get(url)
         self.assertContains(response, "4 results")
 
-    def test_product_portfolio_detail_view_tab_vulnerability_view_filters(self):
+    def test_product_portfolio_tab_vulnerability_view_filters(self):
         self.client.login(username="nexb_user", password="secret")
         url = self.product1.get_url("tab_vulnerabilities")
         response = self.client.get(url)
@@ -305,6 +306,149 @@ def test_product_portfolio_detail_view_tab_vulnerability_view_filters(self):
         response = self.client.get(url + "?vulnerabilities-sort=risk_score#vulnerabilities")
         self.assertContains(response, "?vulnerabilities-sort=-risk_score#vulnerabilities")
 
+    def test_product_portfolio_tab_vulnerability_view_packages_row_rendering(self):
+        self.client.login(username="nexb_user", password="secret")
+        # Each have a unique vulnerability, and p1 p2 are sharing a common one.
+        p1 = make_package(self.dataspace, is_vulnerable=True)
+        p2 = make_package(self.dataspace, is_vulnerable=True)
+        p3 = make_package(self.dataspace, is_vulnerable=True)
+        vulnerability1 = make_vulnerability(self.dataspace, affecting=[p1, p2])
+        product1 = make_product(self.dataspace, inventory=[p1, p2, p3])
+
+        url = product1.get_url("tab_vulnerabilities")
+        response = self.client.get(url)
+        expected = f'<td rowspan="2"><strong>{vulnerability1.vcid}</strong></td>'
+        self.assertContains(response, expected, html=True)
+
+        expected = f"""
+        <span data-bs-toggle="modal"
+              data-bs-target="#vulnerability-analysis-modal"
+              data-vulnerability-id="{vulnerability1.vcid}"
+              data-package-identifier="{p1}"
+              data-edit-url="/products/{product1.uuid}/vulnerability_analysis/{vulnerability1.vcid}/{p1.uuid}/"
+        >
+        <button type="button" data-bs-toggle="tooltip" title="Edit" class="btn btn-link p-0"
+                aria-label="Edit">
+            <i class="far fa-edit fa-sm"></i>
+          </button>
+        </span>
+        """
+        self.assertContains(response, expected, html=True)
+
+    def test_product_portfolio_tab_vulnerability_view_queries(self):
+        self.client.login(username="nexb_user", password="secret")
+        # Each have a unique vulnerability, and p1 p2 are sharing a common one.
+        p1 = make_package(self.dataspace, is_vulnerable=True)
+        p2 = make_package(self.dataspace, is_vulnerable=True)
+        p3 = make_package(self.dataspace, is_vulnerable=True)
+        vulnerability1 = make_vulnerability(self.dataspace, affecting=[p1, p2])
+        vulnerability2 = make_vulnerability(self.dataspace, affecting=[p2, p3])
+        product1 = make_product(self.dataspace, inventory=[p3])
+
+        product_package1 = make_product_package(product1, package=p1)
+        product_package2 = make_product_package(product1, package=p2)
+        VulnerabilityAnalysis.objects.create(
+            product_package=product_package1,
+            vulnerability=vulnerability1,
+            state=VulnerabilityAnalysis.State.RESOLVED,
+            dataspace=self.dataspace,
+        )
+        VulnerabilityAnalysis.objects.create(
+            product_package=product_package2,
+            vulnerability=vulnerability1,
+            state=VulnerabilityAnalysis.State.RESOLVED,
+            dataspace=self.dataspace,
+        )
+        VulnerabilityAnalysis.objects.create(
+            product_package=product_package2,
+            vulnerability=vulnerability2,
+            state=VulnerabilityAnalysis.State.RESOLVED,
+            dataspace=self.dataspace,
+        )
+
+        url = product1.get_url("tab_vulnerabilities")
+        with self.assertNumQueries(9):
+            self.client.get(url)
+
+    def test_product_portfolio_tab_vulnerability_view_analysis_rendering(self):
+        self.client.login(username="nexb_user", password="secret")
+        # Each have a unique vulnerability, and p1 p2 are sharing a common one.
+        p1 = make_package(self.dataspace, is_vulnerable=True)
+        p2 = make_package(self.dataspace, is_vulnerable=True)
+        vulnerability1 = make_vulnerability(self.dataspace, affecting=[p1, p2])
+        product1 = make_product(self.dataspace)
+        product_package1 = make_product_package(product1, package=p1)
+        make_product_package(product1, package=p2)
+
+        analysis = VulnerabilityAnalysis.objects.create(
+            product_package=product_package1,
+            vulnerability=vulnerability1,
+            state=VulnerabilityAnalysis.State.RESOLVED,
+            justification=VulnerabilityAnalysis.Justification.CODE_NOT_PRESENT,
+            responses=[
+                VulnerabilityAnalysis.Response.CAN_NOT_FIX,
+                VulnerabilityAnalysis.Response.ROLLBACK,
+            ],
+            detail="detail",
+            dataspace=self.dataspace,
+        )
+
+        url = product1.get_url("tab_vulnerabilities")
+        response = self.client.get(url)
+
+        # Make sure the Analysis was set on the proper package instance.
+        vulnerabilities = response.context["page_obj"].object_list
+        packages = {
+            package.uuid: package
+            for vulnerability in vulnerabilities
+            for package in vulnerability.affected_packages.all()
+        }
+        self.assertTrue(hasattr(packages.get(p1.uuid), "vulnerability_analysis"))
+        self.assertEqual(analysis, packages.get(p1.uuid).vulnerability_analysis)
+        self.assertFalse(hasattr(packages.get(p2.uuid), "vulnerability_analysis"))
+
+        expected = """
+        <td>
+          <strong>Resolved</strong>
+          <span data-bs-toggle="popover" data-bs-placement="right" data-bs-trigger="hover focus"
+                data-bs-html="true" data-bs-content="detail">
+            <i class="fa-solid fa-circle-info"></i>
+          </span>
+        </td>
+        <td>Code Not Present</td>
+        <td>can_not_fix<br>rollback</td>
+        """
+        self.assertContains(response, expected, html=True)
+
+    @mock.patch("dejacode_toolkit.vulnerablecode.VulnerableCode.is_configured")
+    def test_product_portfolio_detail_view_include_tab_vulnerability_analysis_modal(
+        self, mock_is_configured
+    ):
+        mock_is_configured.return_value = True
+        self.client.login(username="nexb_user", password="secret")
+        url = self.product1.get_absolute_url()
+        modal_id = 'id="vulnerability-analysis-modal"'
+        modal_js = "$('#vulnerability-analysis-modal')"
+
+        self.assertFalse(self.dataspace.enable_vulnerablecodedb_access)
+        response = self.client.get(url)
+        self.assertNotContains(response, modal_id)
+        self.assertNotContains(response, modal_js)
+
+        self.dataspace.enable_vulnerablecodedb_access = True
+        self.dataspace.save()
+        self.assertEqual(0, self.product1.get_vulnerability_qs().count())
+        response = self.client.get(url)
+        self.assertNotContains(response, modal_id)
+        self.assertNotContains(response, modal_js)
+
+        package1 = make_package(self.dataspace, is_vulnerable=True)
+        make_product_package(self.product1, package=package1)
+        self.assertEqual(1, self.product1.get_vulnerability_qs().count())
+        response = self.client.get(url)
+        self.assertContains(response, modal_id)
+        self.assertContains(response, modal_js)
+
     @mock.patch("dejacode_toolkit.vulnerablecode.VulnerableCode.is_configured")
     def test_product_portfolio_detail_view_tab_vulnerability_label(self, mock_is_configured):
         mock_is_configured.return_value = True
@@ -322,9 +466,7 @@ def test_product_portfolio_detail_view_tab_vulnerability_label(self, mock_is_con
         self.assertContains(response, expected)
 
         package1 = make_package(self.dataspace, is_vulnerable=True)
-        ProductPackage.objects.create(
-            product=self.product1, package=package1, dataspace=self.dataspace
-        )
+        make_product_package(self.product1, package=package1)
         response = self.client.get(url)
         expected = '<span class="badge badge-vulnerability">1</span>'
         self.assertContains(response, expected)
@@ -3234,3 +3376,36 @@ def test_product_portfolio_improve_packages_from_purldb_task(self, mock_improve)
         self.assertEqual(import_project.status, ScanCodeProject.Status.SUCCESS)
         expected = ["Improved packages from PurlDB:", "pkg1, pkg2"]
         self.assertEqual(expected, import_project.import_log)
+
+    def test_product_portfolio_vulnerability_analysis_form_view(self):
+        self.client.login(username=self.super_user.username, password="secret")
+
+        package1 = make_package(self.dataspace)
+        vulnerability1 = make_vulnerability(self.dataspace, affecting=[package1])
+        product1 = make_product(self.dataspace, inventory=[package1])
+
+        url = reverse(
+            "product_portfolio:vulnerability_analysis_form",
+            args=[product1.uuid, vulnerability1.vulnerability_id, package1.uuid],
+        )
+
+        response = self.client.get(url)
+        self.assertContains(response, 'name="csrfmiddlewaretoken')
+        self.assertContains(response, 'name="product_package"')
+        self.assertContains(response, 'name="state"')
+        self.assertContains(response, 'name="justification"')
+        self.assertEqual(0, VulnerabilityAnalysis.objects.count())
+
+        product_package = ProductPackage.objects.get(product=product1, package=package1)
+        data = {
+            "product_package": product_package.pk,
+            "vulnerability": vulnerability1.pk,
+            "state": "resolved",
+        }
+        response = self.client.post(url, data=data)
+        self.assertEqual(b'{"success": "updated"}', response.content)
+        self.assertEqual(1, VulnerabilityAnalysis.objects.count())
+        analysis = VulnerabilityAnalysis.objects.get()
+        self.assertEqual(product_package, analysis.product_package)
+        self.assertEqual(vulnerability1, analysis.vulnerability)
+        self.assertEqual("resolved", analysis.state)
diff --git a/product_portfolio/urls.py b/product_portfolio/urls.py
index d96e3b79..56264741 100644
--- a/product_portfolio/urls.py
+++ b/product_portfolio/urls.py
@@ -37,6 +37,7 @@
 from product_portfolio.views import license_summary_view
 from product_portfolio.views import scan_all_packages_view
 from product_portfolio.views import scancodeio_project_status_view
+from product_portfolio.views import vulnerability_analysis_form_view
 
 # WARNING: For views that takes a Product instance in the URL, we need
 # 2 patterns to support Product with and without version, as the version
@@ -79,7 +80,13 @@ def product_path(path_segment, view):
         edit_productrelation_ajax_view,
         name="edit_productrelation_ajax",
     ),
+    path(
+        "<uuid:product_uuid>/vulnerability_analysis/<str:vulnerability_id>/<uuid:package_uuid>/",
+        vulnerability_analysis_form_view,
+        name="vulnerability_analysis_form",
+    ),
     *product_path("add_customcomponent_ajax", add_customcomponent_ajax_view),
+    *product_path("vulnerability_analysis_form", vulnerability_analysis_form_view),
     *product_path("scan_all_packages", scan_all_packages_view),
     *product_path("improve_packages_from_purldb", improve_packages_from_purldb_view),
     *product_path("about_files", ProductSendAboutFilesView.as_view()),
diff --git a/product_portfolio/views.py b/product_portfolio/views.py
index ee74b54d..bce2379d 100644
--- a/product_portfolio/views.py
+++ b/product_portfolio/views.py
@@ -25,6 +25,7 @@
 from django.core.paginator import Paginator
 from django.db import transaction
 from django.db.models import Count
+from django.db.models import ObjectDoesNotExist
 from django.db.models import Prefetch
 from django.db.models.functions import Lower
 from django.forms import modelformset_factory
@@ -34,6 +35,7 @@
 from django.shortcuts import get_object_or_404
 from django.shortcuts import redirect
 from django.shortcuts import render
+from django.template.context_processors import csrf
 from django.template.response import TemplateResponse
 from django.urls import reverse
 from django.utils.decorators import method_decorator
@@ -128,9 +130,11 @@
 from product_portfolio.models import ProductPackage
 from product_portfolio.models import ProductRelationshipMixin
 from product_portfolio.models import ScanCodeProject
-from vulnerabilities.filters import VulnerabilityFilterSet
+from vulnerabilities.filters import ProductVulnerabilityFilterSet
+from vulnerabilities.forms import VulnerabilityAnalysisForm
 from vulnerabilities.models import AffectedByVulnerabilityMixin
 from vulnerabilities.models import Vulnerability
+from vulnerabilities.models import VulnerabilityAnalysis
 
 
 class BaseProductViewMixin:
@@ -535,8 +539,7 @@ def tab_vulnerabilities(self):
         if not all(display_tab_contions):
             return
 
-        vulnerability_qs = self.object.get_vulnerability_qs()
-        vulnerability_count = vulnerability_qs.count()
+        vulnerability_count = self.object.vulnerability_count
         if not vulnerability_count:
             label = 'Vulnerabilities <span class="badge bg-secondary">0</span>'
             return {
@@ -1106,25 +1109,44 @@ class ProductTabVulnerabilitiesView(
     query_dict_page_param = "vulnerabilities-page"
     tab_id = "vulnerabilities"
     table_model = Vulnerability
-    filterset_class = VulnerabilityFilterSet
+    filterset_class = ProductVulnerabilityFilterSet
     table_headers = (
         Header("vulnerability_id", _("Vulnerability")),
-        Header("affected_packages", _("Affected packages"), help_text="Affected product packages"),
         Header("exploitability", _("Exploitability"), filter="exploitability"),
         Header("weighted_severity", _("Severity"), filter="weighted_severity"),
         Header("risk_score", _("Risk"), filter="risk_score"),
-        Header("summary", _("Summary")),
+        Header("affected_packages", _("Affected packages"), help_text="Affected product packages"),
+        Header(
+            "vulnerability_analyses__state",
+            _("Status"),
+            help_text=_("Exploitability analysis status"),
+            filter="vulnerability_analyses__state",
+        ),
+        Header(
+            "vulnerability_analyses__justification",
+            _("Justification"),
+            help_text=_("The rationale of why the impact analysis state was asserted."),
+            filter="vulnerability_analyses__justification",
+        ),
+        Header(
+            "vulnerability_analyses__responses",
+            _("Responses"),
+            help_text=_(
+                "A response to the vulnerability by the manufacturer, supplier, or project "
+                "responsible for the affected component or service."
+            ),
+            filter="responses",
+        ),
     )
 
     def get_context_data(self, **kwargs):
         product = self.object
-        base_vulnerability_qs = product.get_vulnerability_qs()
-        total_count = base_vulnerability_qs.count()
-
-        package_qs = Package.objects.filter(product=product).only_rendering_fields()
-        vulnerability_qs = base_vulnerability_qs.prefetch_related(
-            Prefetch("affected_packages", package_qs)
-        ).order_by_risk()
+        total_count = product.get_vulnerability_qs().count()
+        vulnerability_qs = (
+            product.get_vulnerability_qs(prefetch_related_packages=True)
+            .annotate(affected_packages_count=Count("affected_packages"))
+            .order_by_risk()
+        )
 
         self.filterset = self.filterset_class(
             self.request.GET,
@@ -1141,6 +1163,16 @@ def get_context_data(self, **kwargs):
         page_number = self.request.GET.get(self.query_dict_page_param)
         page_obj = paginator.get_page(page_number)
 
+        # Set the proper VulnerabilityAnalysis instance on the Package instance
+        for vulnerability in page_obj.object_list:
+            for package in vulnerability.affected_packages.all():
+                # Using the following instead of .filter(package=package) to avoid
+                # duplicated queries.
+                for analysis in vulnerability.vulnerability_analyses.all():
+                    if analysis.package == package:
+                        package.vulnerability_analysis = analysis
+                        continue
+
         context_data.update(
             {
                 "filterset": self.filterset,
@@ -2427,3 +2459,41 @@ def improve_packages_from_purldb_view(request, dataspace, name, version=""):
         )
         messages.success(request, "Improve Packages from PurlDB in progress...")
     return redirect(f"{product.get_absolute_url()}#imports")
+
+
+@login_required
+def vulnerability_analysis_form_view(request, product_uuid, vulnerability_id, package_uuid):
+    user = request.user
+    form_class = VulnerabilityAnalysisForm
+    perms = "change_product"
+
+    qs = Product.objects.get_queryset(user, perms=perms)
+    product = get_object_or_404(qs, uuid=product_uuid)
+    vulnerability_qs = Vulnerability.objects.scope(user.dataspace)
+    vulnerability = get_object_or_404(vulnerability_qs, vulnerability_id=vulnerability_id)
+    product_package_qs = ProductPackage.objects.product_secured(user, perms=perms)
+    product_package = get_object_or_404(
+        product_package_qs, product=product, package__uuid=package_uuid
+    )
+
+    try:
+        vulnerability_analysis = VulnerabilityAnalysis.objects.scope(user.dataspace).get(
+            product_package=product_package,
+            vulnerability=vulnerability,
+        )
+    except ObjectDoesNotExist:
+        vulnerability_analysis = None  # Addition
+
+    if request.method == "POST":
+        form = form_class(user, instance=vulnerability_analysis, data=request.POST)
+        if form.is_valid():
+            form.save()
+            messages.success(request, "Vulnerability analysis successfully updated.")
+            return JsonResponse({"success": "updated"}, status=200)
+    else:
+        initial = {"product_package": product_package, "vulnerability": vulnerability}
+        form = form_class(user, instance=vulnerability_analysis, initial=initial)
+
+    rendered_form = render_crispy_form(form, context=csrf(request))
+
+    return HttpResponse(rendered_form)
diff --git a/vulnerabilities/filters.py b/vulnerabilities/filters.py
index e6f627fd..8ec23c82 100644
--- a/vulnerabilities/filters.py
+++ b/vulnerabilities/filters.py
@@ -13,9 +13,9 @@
 
 from dje.filters import DataspacedFilterSet
 from dje.filters import SearchFilter
-from dje.widgets import DropDownRightWidget
 from dje.widgets import SortDropDownWidget
 from vulnerabilities.models import Vulnerability
+from vulnerabilities.models import VulnerabilityAnalysisMixin
 
 RISK_SCORE_RANGES = {
     "low": (0.1, 2.9),
@@ -72,6 +72,11 @@ def filter(self, qs, value):
 
 
 class VulnerabilityFilterSet(DataspacedFilterSet):
+    dropdown_fields = [
+        "exploitability",
+        "weighted_severity",
+        "risk_score",
+    ]
     q = SearchFilter(
         label=_("Search"),
         search_fields=["vulnerability_id", "aliases"],
@@ -83,6 +88,7 @@ class VulnerabilityFilterSet(DataspacedFilterSet):
             "weighted_severity",
             "risk_score",
             "affected_products_count",
+            "affected_packages",
             "affected_packages_count",
             "fixed_packages_count",
             "created_date",
@@ -106,8 +112,44 @@ class Meta:
             "exploitability",
         ]
 
+
+# Add few filters specific to the Product Vulnerabilities tab.
+class ProductVulnerabilityFilterSet(VulnerabilityFilterSet):
+    dropdown_fields = [
+        "exploitability",
+        "weighted_severity",
+        "risk_score",
+        "vulnerability_analyses__state",
+        "vulnerability_analyses__justification",
+        "responses",
+    ]
+    sort = NullsLastOrderingFilter(
+        label=_("Sort"),
+        fields=[
+            "exploitability",
+            "weighted_severity",
+            "risk_score",
+            "affected_packages",
+            "vulnerability_analyses__state",
+        ],
+        widget=SortDropDownWidget,
+    )
+    responses = django_filters.ChoiceFilter(
+        field_name="vulnerability_analyses__responses",
+        lookup_expr="icontains",
+        choices=VulnerabilityAnalysisMixin.Response.choices,
+    )
+
+    class Meta:
+        model = Vulnerability
+        fields = [
+            "q",
+            "vulnerability_analyses__state",
+            "vulnerability_analyses__justification",
+            "exploitability",
+        ]
+
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
-        self.filters["exploitability"].extra["widget"] = DropDownRightWidget(anchor=self.anchor)
-        self.filters["weighted_severity"].extra["widget"] = DropDownRightWidget(anchor=self.anchor)
-        self.filters["risk_score"].extra["widget"] = DropDownRightWidget(anchor=self.anchor)
+        self.filters["vulnerability_analyses__state"].extra["null_label"] = "(No values)"
+        self.filters["vulnerability_analyses__justification"].extra["null_label"] = "(No values)"
diff --git a/vulnerabilities/forms.py b/vulnerabilities/forms.py
new file mode 100644
index 00000000..807e3277
--- /dev/null
+++ b/vulnerabilities/forms.py
@@ -0,0 +1,67 @@
+#
+# Copyright (c) nexB Inc. and others. All rights reserved.
+# DejaCode is a trademark of nexB Inc.
+# SPDX-License-Identifier: AGPL-3.0-only
+# See https://github.com/aboutcode-org/dejacode for support or download.
+# See https://aboutcode.org for more information about AboutCode FOSS projects.
+#
+
+from django import forms
+from django.core.exceptions import ValidationError
+
+from crispy_forms.helper import FormHelper
+
+from dje.forms import DataspacedModelForm
+from product_portfolio.models import ProductPackage
+from vulnerabilities.models import VulnerabilityAnalysis
+
+
+class VulnerabilityAnalysisForm(DataspacedModelForm):
+    responses = forms.MultipleChoiceField(
+        choices=VulnerabilityAnalysis.Response.choices,
+        widget=forms.CheckboxSelectMultiple,
+        required=False,
+    )
+
+    class Meta:
+        model = VulnerabilityAnalysis
+        fields = [
+            "product_package",
+            "vulnerability",
+            "state",
+            "justification",
+            "responses",
+            "detail",
+        ]
+        widgets = {
+            "product_package": forms.widgets.HiddenInput,
+            "vulnerability": forms.widgets.HiddenInput,
+            "detail": forms.Textarea(attrs={"rows": 3}),
+        }
+
+    def __init__(self, user, *args, **kwargs):
+        super().__init__(user, *args, **kwargs)
+
+        responses_model_field = self._meta.model._meta.get_field("responses")
+        self.fields["responses"].help_text = responses_model_field.help_text
+
+        product_package_field = self.fields["product_package"]
+        perms = ["view_product", "change_product"]
+        product_package_field.queryset = ProductPackage.objects.product_secured(user, perms=perms)
+
+    @property
+    def helper(self):
+        helper = FormHelper()
+        helper.form_method = "post"
+        helper.form_id = "product-vulnerability-analysis-form"
+        helper.form_tag = False
+        helper.modal_title = "Vulnerability analysis"
+        helper.modal_id = "vulnerability-analysis-modal"
+        return helper
+
+    def clean(self):
+        main_fields = ["state", "justification", "responses", "detail"]
+        if not any(self.cleaned_data.get(field_name) for field_name in main_fields):
+            raise ValidationError(
+                "At least one of state, justification, responses or detail must be provided."
+            )
diff --git a/vulnerabilities/migrations/0003_vulnerabilityanalysis.py b/vulnerabilities/migrations/0003_vulnerabilityanalysis.py
new file mode 100644
index 00000000..a9824d8b
--- /dev/null
+++ b/vulnerabilities/migrations/0003_vulnerabilityanalysis.py
@@ -0,0 +1,45 @@
+# Generated by Django 5.0.9 on 2024-11-29 14:38
+
+import django.contrib.postgres.fields
+import django.db.models.deletion
+import dje.fields
+import uuid
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('component_catalog', '0010_component_risk_score_package_risk_score'),
+        ('dje', '0004_dataspace_vulnerabilities_updated_at'),
+        ('product_portfolio', '0008_productdependency_is_resolved_to_is_pinned'),
+        ('vulnerabilities', '0002_remove_vulnerability_max_score_and_more'),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='VulnerabilityAnalysis',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('uuid', models.UUIDField(default=uuid.uuid4, editable=False, verbose_name='UUID')),
+                ('state', models.CharField(blank=True, choices=[('resolved', 'Resolved'), ('resolved_with_pedigree', 'Resolved With Pedigree'), ('exploitable', 'Exploitable'), ('in_triage', 'In Triage'), ('false_positive', 'False Positive'), ('not_affected', 'Not Affected')], help_text='Declares the current state of an occurrence of a vulnerability, after automated or manual analysis.', max_length=25)),
+                ('justification', models.CharField(blank=True, choices=[('code_not_present', 'Code Not Present'), ('code_not_reachable', 'Code Not Reachable'), ('protected_at_perimeter', 'Protected At Perimeter'), ('protected_at_runtime', 'Protected At Runtime'), ('protected_by_compiler', 'Protected By Compiler'), ('protected_by_mitigating_control', 'Protected By Mitigating Control'), ('requires_configuration', 'Requires Configuration'), ('requires_dependency', 'Requires Dependency'), ('requires_environment', 'Requires Environment')], help_text='The rationale of why the impact analysis state was asserted.', max_length=35)),
+                ('responses', django.contrib.postgres.fields.ArrayField(base_field=models.CharField(choices=[('can_not_fix', 'Can Not Fix'), ('rollback', 'Rollback'), ('update', 'Update'), ('will_not_fix', 'Will Not Fix'), ('workaround_available', 'Workaround Available')], max_length=20), blank=True, help_text='A response to the vulnerability by the manufacturer, supplier, or project responsible for the affected component or service. More than one response is allowed. Responses are strongly encouraged for vulnerabilities where the analysis state is exploitable.', null=True, size=None)),
+                ('detail', models.TextField(blank=True, help_text='Detailed description of the impact including methods used during assessment. If a vulnerability is not exploitable, this field should include specific details on why the component or service is not impacted by this vulnerability.')),
+                ('first_issued', models.DateTimeField(auto_now_add=True, help_text='The date and time (timestamp) when the analysis was first issued.')),
+                ('last_updated', models.DateTimeField(auto_now=True, help_text='The date and time (timestamp) when the analysis was last updated.')),
+                ('created_by', models.ForeignKey(editable=False, help_text='The application user who created the object.', null=True, on_delete=django.db.models.deletion.PROTECT, related_name='created_%(class)ss', serialize=False, to=settings.AUTH_USER_MODEL)),
+                ('dataspace', models.ForeignKey(editable=False, help_text='A Dataspace is an independent, exclusive set of DejaCode data, which can be either nexB master reference data or installation-specific data.', on_delete=django.db.models.deletion.PROTECT, to='dje.dataspace')),
+                ('last_modified_by', dje.fields.LastModifiedByField(editable=False, help_text='The application user who last modified the object.', null=True, on_delete=django.db.models.deletion.PROTECT, related_name='modified_%(class)ss', serialize=False, to=settings.AUTH_USER_MODEL)),
+                ('package', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='vulnerability_analyses', to='component_catalog.package')),
+                ('product', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='vulnerability_analyses', to='product_portfolio.product')),
+                ('product_package', models.ForeignKey(help_text='The ProductPackage relationship being analyzed.', on_delete=django.db.models.deletion.CASCADE, related_name='vulnerability_analyses', to='product_portfolio.productpackage')),
+                ('vulnerability', models.ForeignKey(help_text='The vulnerability being analyzed in the context of the ProductPackage.', on_delete=django.db.models.deletion.CASCADE, related_name='vulnerability_analyses', to='vulnerabilities.vulnerability')),
+            ],
+            options={
+                'unique_together': {('dataspace', 'uuid'), ('product_package', 'vulnerability')},
+            },
+        ),
+    ]
diff --git a/vulnerabilities/models.py b/vulnerabilities/models.py
index 726801f9..c3a123da 100644
--- a/vulnerabilities/models.py
+++ b/vulnerabilities/models.py
@@ -21,6 +21,7 @@
 from dje.models import DataspacedModel
 from dje.models import DataspacedQuerySet
 from dje.models import HistoryDateFieldsMixin
+from dje.models import HistoryUserFieldsMixin
 
 logger = logging.getLogger("dje")
 
@@ -194,12 +195,14 @@ def create_from_data(cls, dataspace, data, validate=False, affecting=None):
 
         return instance
 
-    def as_cyclonedx(self, affected_instances):
+    def as_cyclonedx(self, affected_instances, analysis=None):
         affects = [
             cdx_vulnerability.BomTarget(ref=instance.cyclonedx_bom_ref)
             for instance in affected_instances
         ]
 
+        analysis = analysis.as_cyclonedx() if analysis else None
+
         source = cdx_vulnerability.VulnerabilitySource(
             name="VulnerableCode",
             url=self.resource_url,
@@ -250,6 +253,7 @@ def as_cyclonedx(self, affected_instances):
             affects=affects,
             references=sorted(references),
             ratings=ratings,
+            analysis=analysis,
         )
 
 
@@ -269,7 +273,7 @@ class State(models.TextChoices):
     class Justification(models.TextChoices):
         CODE_NOT_PRESENT = "code_not_present"
         CODE_NOT_REACHABLE = "code_not_reachable"
-        PROTECTED_AT_PERIMITER = "protected_at_perimeter"
+        PROTECTED_AT_PERIMETER = "protected_at_perimeter"
         PROTECTED_AT_RUNTIME = "protected_at_runtime"
         PROTECTED_BY_COMPILER = "protected_by_compiler"
         PROTECTED_BY_MITIGATING_CONTROL = "protected_by_mitigating_control"
@@ -350,6 +354,22 @@ def save(self, *args, **kwargs):
 
         super().save(*args, **kwargs)
 
+    def as_cyclonedx(self):
+        state = None
+        if self.state:
+            state = cdx_vulnerability.ImpactAnalysisState(self.state)
+
+        justification = None
+        if self.justification:
+            justification = cdx_vulnerability.ImpactAnalysisJustification(self.justification)
+
+        return cdx_vulnerability.VulnerabilityAnalysis(
+            state=state,
+            justification=justification,
+            responses=self.responses,
+            detail=self.detail,
+        )
+
 
 class AffectedByVulnerabilityRelationship(DataspacedModel):
     vulnerability = models.ForeignKey(
@@ -452,3 +472,45 @@ def create_vulnerabilities(self, vulnerabilities_data):
 
         through_defaults = {"dataspace_id": self.dataspace_id}
         self.affected_by_vulnerabilities.add(*vulnerabilities, through_defaults=through_defaults)
+
+
+class VulnerabilityAnalysis(
+    VulnerabilityAnalysisMixin,
+    HistoryUserFieldsMixin,
+    DataspacedModel,
+):
+    product_package = models.ForeignKey(
+        to="product_portfolio.ProductPackage",
+        on_delete=models.CASCADE,
+        related_name="vulnerability_analyses",
+        help_text=_("The ProductPackage relationship being analyzed."),
+    )
+    vulnerability = models.ForeignKey(
+        to="vulnerabilities.Vulnerability",
+        on_delete=models.CASCADE,
+        related_name="vulnerability_analyses",
+        help_text=_("The vulnerability being analyzed in the context of the ProductPackage."),
+    )
+    # Shortcut fields to simplify QuerySets filtering
+    product = models.ForeignKey(
+        to="product_portfolio.Product",
+        on_delete=models.CASCADE,
+        related_name="vulnerability_analyses",
+    )
+    package = models.ForeignKey(
+        to="component_catalog.Package",
+        on_delete=models.CASCADE,
+        related_name="vulnerability_analyses",
+    )
+
+    class Meta:
+        unique_together = (("product_package", "vulnerability"), ("dataspace", "uuid"))
+
+    def __str__(self):
+        return f"{self.vulnerability} analysis"
+
+    def save(self, *args, **kwargs):
+        """Set the product and package fields values from the product_package FK."""
+        self.product_id = self.product_package.product_id
+        self.package_id = self.product_package.package_id
+        super().save(*args, **kwargs)
diff --git a/vulnerabilities/tests/test_forms.py b/vulnerabilities/tests/test_forms.py
new file mode 100644
index 00000000..852aca86
--- /dev/null
+++ b/vulnerabilities/tests/test_forms.py
@@ -0,0 +1,50 @@
+#
+# Copyright (c) nexB Inc. and others. All rights reserved.
+# DejaCode is a trademark of nexB Inc.
+# SPDX-License-Identifier: AGPL-3.0-only
+# See https://github.com/aboutcode-org/dejacode for support or download.
+# See https://aboutcode.org for more information about AboutCode FOSS projects.
+#
+
+from pathlib import Path
+
+from django.test import TestCase
+
+from dje.models import Dataspace
+from dje.tests import create_superuser
+from product_portfolio.tests import make_product
+from product_portfolio.tests import make_product_package
+from vulnerabilities.forms import VulnerabilityAnalysisForm
+from vulnerabilities.tests import make_vulnerability
+
+
+class VulnerabilitiesFormsTestCase(TestCase):
+    data = Path(__file__).parent / "data"
+
+    def setUp(self):
+        self.dataspace = Dataspace.objects.create(name="nexB")
+        self.super_user = create_superuser("super_user", self.dataspace)
+
+    def test_vulnerability_forms_vulnerability_analysis_save(self):
+        vulnerability1 = make_vulnerability(dataspace=self.dataspace)
+        product_package1 = make_product_package(make_product(self.dataspace))
+
+        data = {
+            "product_package": product_package1,
+            "vulnerability": vulnerability1,
+        }
+
+        form = VulnerabilityAnalysisForm(user=self.super_user, data=data)
+        self.assertFalse(form.is_valid())
+        msg = "At least one of state, justification, responses or detail must be provided."
+        self.assertEqual({"__all__": [msg]}, form.errors)
+
+        data["detail"] = "Analysis detail"
+        form = VulnerabilityAnalysisForm(user=self.super_user, data=data)
+        self.assertTrue(form.is_valid())
+        analysis = form.save()
+        self.assertEqual(vulnerability1, analysis.vulnerability)
+        self.assertEqual(product_package1, analysis.product_package)
+        self.assertEqual(product_package1.product, analysis.product)
+        self.assertEqual(product_package1.package, analysis.package)
+        self.assertEqual(data["detail"], analysis.detail)
diff --git a/vulnerabilities/tests/test_models.py b/vulnerabilities/tests/test_models.py
index 05b00964..aa52e1ca 100644
--- a/vulnerabilities/tests/test_models.py
+++ b/vulnerabilities/tests/test_models.py
@@ -18,11 +18,13 @@
 from dejacode_toolkit.vulnerablecode import VulnerableCode
 from dje.models import Dataspace
 from product_portfolio.tests import make_product
+from product_portfolio.tests import make_product_package
 from vulnerabilities.models import Vulnerability
+from vulnerabilities.models import VulnerabilityAnalysis
 from vulnerabilities.tests import make_vulnerability
 
 
-class VulnerabilitiesFetchTestCase(TestCase):
+class VulnerabilitiesModelsTestCase(TestCase):
     data = Path(__file__).parent / "data"
 
     def setUp(self):
@@ -204,3 +206,54 @@ def test_vulnerability_model_as_cyclonedx(self):
         #     expected_location.write_text(results)
 
         self.assertJSONEqual(results, expected_location.read_text())
+
+        product1 = make_product(self.dataspace)
+        product_package1 = make_product_package(product1, package=package1)
+        analysis = VulnerabilityAnalysis(
+            product_package=product_package1,
+            vulnerability=vulnerability1,
+            state=VulnerabilityAnalysis.State.RESOLVED,
+            justification=VulnerabilityAnalysis.Justification.CODE_NOT_PRESENT,
+            responses=[
+                VulnerabilityAnalysis.Response.CAN_NOT_FIX,
+                VulnerabilityAnalysis.Response.ROLLBACK,
+            ],
+            detail="detail",
+            dataspace=self.dataspace,
+        )
+        vulnerability1_as_cdx = vulnerability1.as_cyclonedx(
+            affected_instances=[package1], analysis=analysis
+        )
+        as_dict = json.loads(vulnerability1_as_cdx.as_json())
+        expected = {
+            "detail": "detail",
+            "justification": "code_not_present",
+            "response": ["can_not_fix", "rollback"],
+            "state": "resolved",
+        }
+        self.assertEqual(expected, as_dict["analysis"])
+
+    def test_vulnerability_model_vulnerability_analysis_save(self):
+        vulnerability1 = make_vulnerability(dataspace=self.dataspace)
+        product_package1 = make_product_package(make_product(self.dataspace))
+
+        analysis = VulnerabilityAnalysis(
+            product_package=product_package1,
+            vulnerability=vulnerability1,
+            dataspace=self.dataspace,
+        )
+
+        msg = "At least one of state, justification, responses or detail must be provided."
+        with self.assertRaisesMessage(ValueError, msg):
+            analysis.save()
+
+        analysis.state = VulnerabilityAnalysis.State.RESOLVED
+        analysis.save()
+
+        # Refresh from db
+        analysis = VulnerabilityAnalysis.objects.get(pk=analysis.pk)
+        self.assertEqual(vulnerability1, analysis.vulnerability)
+        self.assertEqual(product_package1, analysis.product_package)
+        self.assertEqual(product_package1.product, analysis.product)
+        self.assertEqual(product_package1.package, analysis.package)
+        self.assertEqual(VulnerabilityAnalysis.State.RESOLVED, analysis.state)
diff --git a/vulnerabilities/tests/test_views.py b/vulnerabilities/tests/test_views.py
index d08bda62..bb1a23b8 100644
--- a/vulnerabilities/tests/test_views.py
+++ b/vulnerabilities/tests/test_views.py
@@ -6,7 +6,6 @@
 # See https://aboutcode.org for more information about AboutCode FOSS projects.
 #
 
-from django.contrib.auth import get_user_model
 from django.test import TestCase
 from django.urls import reverse
 
@@ -17,8 +16,6 @@
 from vulnerabilities.models import Vulnerability
 from vulnerabilities.tests import make_vulnerability
 
-User = get_user_model()
-
 
 class VulnerabilityViewsTestCase(TestCase):
     def setUp(self):