Embracing the Era of Transparency: Automating VEX Application for Scalable, Context-Aware Security
summary
NVIDIA builds an automated VEX pipeline that scans container images, applies rule engines (parent image inheritance, vendor overlays, and manual review workflows), and emits CycloneDX/OpenVEX VEX documents attached as cosign attestations to artifacts. The internal VEX Stream generates and publishes roughly 700,000 VEX documents over two years, but many scanners do not yet consume attestations so customers still see full vuln lists; Trivy has an experimental VEX option that partly enables automatic filtering.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:13Nvidia embraces VEX transparency
- 3:20Nvidia product and CVE challenges
- 5:48Early VEX journey and manual publishing
- 7:31Automating VEX generation at scale
- 9:38Customers still ask about CVEs
- 11:42Broken VEX workflow
- 12:47Solution for VEX automation
- 15:12Demo of tooling gaps
- 21:34Call for ecosystem collaboration
- 22:57Summary
related talks
26mStreamlining Vulnerability Management: The Power of VEX Inheritance in Container Ecosystems
19mFinally! Automated End-to-End VEX Streams You Can Trust
27mWeaving a VEX Feed Through the Kubernetes Project
45mVEXing Open Source Security: Vulnerability Data for Everything
48m5 Steps to VEX Success: Managing the End-to-End Workflow
26mWeaving a VEX Feed Through the Kubernetes Project
50mDemocratizing Exploitability Data with OpenVEX
33mHow to Generate VEX Automatically for Your Project