Taming the Scanner Storm: How VEX Brings Context to Vulnerability Data
summary
NVIDIA overlays vendor VEX onto container OS scan results to separate actionable fixes from unresolved or unaffected findings, using a two-stage VEX pipeline (continuous ingestion/normalization from Ubuntu and Red Hat, then rules‑based synthesis). It scans ~34,000 images daily, yielding 26 million findings across ~24,000 CVEs, of which ~66% have no vendor patch; the system produces 94% VEX‑informed decisions for CVEs ≥2020 and auto‑classifies ~84% of medium/low no‑fix findings to cut manual triage.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:06Vulnerability data overload
- 6:49VEX overlay architecture
- 10:01VEX processing rules
- 13:27VEX impact metrics
- 18:49CVE journey example
- 20:12Lessons learned
- 22:01Key takeaways
- 23:39Q&A
related talks
50mBOF - Discussion Regarding False Positive Results from Vulnerability Scanners and the Use of VEX
31mVEX! or... How to Reduce CVE Noise With One Simple Trick!
42mScan, Patch, VEX - Using Open Source Tools to Manage...
45mVEXing Open Source Security: Vulnerability Data for Everything
24mOvercoming CVE Shock - Adding Perspective in Vulnerability Scanning
27mWeaving a VEX Feed Through the Kubernetes Project
45mCSAF/VEX: Improved Security Data
26mStreamlining Vulnerability Management: The Power of VEX Inheritance in Container Ecosystems