5 Steps to VEX Success: Managing the End-to-End Workflow
summary
States five concrete steps: generate SBOMs, detect vulnerabilities via SCA and CVE feeds, decompose with EPSS reachability and CISA KEV, triage by impact and fix-grouping, then publish standalone VEX records (CycloneDX/SPDX or OpenVEX) and consume them. Cites ~29,000 CVEs per year and demonstrates an EPSS 0.22 threshold → ~90% coverage with 15% effort to cut false positives. Insists on purl over CPE for unique IDs and on separate VEX from SBOM (publish OpenVEX) for continuous automated workflows.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 2:29CVE noise problem
- 8:22EPSS and vulnerability decomposition
- 16:23ESPM and SBOMs
- 17:26What is VEX
- 23:25Vulnerability detection for VEX
- 26:31Ongoing vulnerability response
- 33:50Communicating VEX status
- 37:40Consuming VEX statements
- 39:47Key takeaways
- 41:11Q&A
related talks
32mUnderstanding Exploitability with VEX, EPSS, and Other Standard Frameworks
45mVEXing Open Source Security: Vulnerability Data for Everything
31mVEX! or... How to Reduce CVE Noise With One Simple Trick!
50mBOF - Discussion Regarding False Positive Results from Vulnerability Scanners and the Use of VEX
24mEmbracing the Era of Transparency: Automating VEX Application for Scalable, Context-Aware Security
47mI Can’t Cope! How OWASP Is Helping To Manage Vulnerability Overload
47mVEX Overview
27mWeaving a VEX Feed Through the Kubernetes Project