Panel: The CVE Supplier ADP (SADP) Pilot: Am I Affected byUpstream?
summary
CVE adds Supplier ADP (SADP) pilot containers to CVE records to publish VEX-like inherited vulnerability status, using the existing CVE-Services ADP endpoint and schema; Siemens publishes ~20 production SADP records and Microsoft contributes 100+ while Azure Linux has ~8–9k VEX attestations. Qualys reports releasing 100,000 signatures for 46,000 CVEs and a median 12‑hour turnaround for critical/zero‑day detections. The pilot proves feasibility but surfaces hard questions about scale, provenance versus pointers, required automation, and whether containers should embed data or reference external VEX/CSAF files.
AI-written summary · about
chapters (17)
- 0:00Welcome
- 1:30Panelist intros
- 5:01Supplier ADP pilot
- 12:27Microsoft’s SADP approach
- 15:11Upstream-downstream challenges
- 17:39Q&A
- 22:00Qualys on SADP benefits
- 23:04Downstream impact concerns
- 31:11VEX origins and SADP
- 32:35Pilot outcomes
- 34:22Contextualized vulnerability data
- 36:29VEX automation costs
- 39:24Scaling SADP dependencies
- 41:12Centralized vs distributed SADP
- 44:40Trust in SADP sources
- 49:58SADP data conflicts
- 51:43Closing
related talks
45mFuture of CVE
50mBOF - Discussion Regarding False Positive Results from Vulnerability Scanners and the Use of VEX
45mCSAF/VEX: Improved Security Data
39mCSAF - the Magic Potion for Vulnerability Handling in Industrial Environments
32mUnderstanding Exploitability with VEX, EPSS, and Other Standard Frameworks
51mPanel Discussion: It is a Tale as Old as Time…. a CNA, the NVD, and a CVE Consumer Walk Into a ...
30mVulnrichment: Year One
45mVEXing Open Source Security: Vulnerability Data for Everything