Big companies usually use some sort of vulnerability response management software which is connected to your CMDB, ideally containing SBOMs of everything you use, and subscribed to various providers of CVEs. Those tools then map the CVEs to your SBOMs and you'll get alerts, security incidents and so on.