BOF - Discussion Regarding False Positive Results from Vulnerability Scanners and the Use of VEX
summary
Claims that VEX will cut scanner false positives by encoding VEX attestation status for each CVE and that CESAF/OpenVEX exports can be automated; Red Hat and Microsoft already produce VEX-like files, Microsoft started publishing CESAF in November and plans per-product VEX (potentially for 250,000 CVEs), but ingestion is blocked by missing metadata, multiple competing formats, and tooling. Scanners still pull ~90% of data from NVD, SBOM storage already hits ~200 GB, and the community proposes a centralized vendor feed and robust readers to make it usable.
AI-written summary · about
chapters (24)
- 0:00VEX and industry collaboration
- 1:25Common VEX standards and adoption
- 5:02VEX in vulnerability management
- 7:11Producers' VEX challenges
- 9:22Scanners ingesting VEX data
- 11:46VEX addressing false positives
- 14:14Commercial feeds and vendor trust
- 16:22Microsoft's CESAF approach
- 19:14Customers' vendor perspectives
- 21:44VEX resource constraints
- 25:14VEX standards fragmentation
- 27:01VEX in CVE and ADP discussions
- 29:52Centralizing CV.org data
- 31:36Funding for vulnerability databases
- 33:29Customers' vulnerability data needs
- 35:22VEX feedback mechanisms
- 37:13Scanners parsing VEX data
- 39:00False positives and scanner struggles
- 41:05Centralization for data fragmentation
- 42:48Automation in vulnerability management
- 44:23Asset management and diagnostics
- 46:13Shared responsibility for VEX
- 47:41Collaborative steps for VEX
- 48:44Call to action for VEX
related talks
45mCSAF/VEX: Improved Security Data
30mTaming the Scanner Storm: How VEX Brings Context to Vulnerability Data
31mVEX! or... How to Reduce CVE Noise With One Simple Trick!
45mVEXing Open Source Security: Vulnerability Data for Everything
32mUnderstanding Exploitability with VEX, EPSS, and Other Standard Frameworks
48m5 Steps to VEX Success: Managing the End-to-End Workflow
17mThe Hidden Cost of CVEs: Can CSAF and VEX Change the Equation?
50mDemocratizing Exploitability Data with OpenVEX