Triaging an advisory or scanner result
- Prioritize vulnerabilities by exploitation, exposure and impact
- Triage new dependency vulnerability findings
- Respond to an exploited or malicious dependency
- Use VEX without losing vulnerability evidence
- Generate an SBOM for the software you actually release
- Choose SBOM formats and identify components accurately
- Review SBOM changes between releases
- Case study: Spring4Shell (CVE-2022-22965)
- Case study: ingress-nginx CVE-2025-1974 and the exposed admission webhook (2025)
Practice: SBOM completeness lab
A suspicious or malicious package
- Investigate a suspected malicious package safely
- Stop dependency confusion and typosquatting at install time
- Review dependency health without treating a score as a guarantee
- Protect package publication and the update channel
- Case study: the Shai-Hulud npm worm (2025-2026)
- Case study: the xz Utils backdoor (CVE-2024-3094)
- Case study: event-stream and ua-parser-js, two npm package takeovers
- Case study: the polyfill.io CDN takeover (2024)
- Adopt the OpenSSF S2C2F as a consumer: the eight practices, the four maturity levels and a staged plan with evidence
- Case study: the Nx s1ngularity compromise and its AI-assisted payload (2025)
A leaked secret
- Contain a leaked secret, then investigate and clean up
- Secrets management: storage, rotation and leaked-secret response
- Workload identity federation: short-lived, scoped identities for services and CI
- Keep untrusted CI work outside the release boundary
- Case study: the tj-actions/changed-files compromise (CVE-2025-30066)
- Case study: the Okta support-system breach and session tokens in HAR files (2023)
- Case study: the Codecov Bash Uploader compromise (2021)
- Case study: the CircleCI security incident (January 2023)
- Case study: Microsoft AI researchers' over-permissive SAS token (2023)
An attack in progress
- Turn runtime events into a tested investigation and containment path
- Create security logs someone can investigate
- Operate edge rules without hiding application defects
- Case study: Log4Shell (CVE-2021-44228)
- Case study: MOVEit Transfer mass exploitation (CVE-2023-34362)
- Detect container and host threats at runtime with eBPF sensors and cloud services
- Keep HTTP services up under application-layer DDoS
- Case study: Citrix Bleed (CVE-2023-4966)
Disclosure and reporting obligations
- Run coordinated vulnerability disclosure from report to advisory
- Start with a VDP, then add bug bounties and penetration tests
- Build a runbook for CRA vulnerability and incident reporting
- Cyber Resilience Act and payment pages: turn product-security obligations into an engineering evidence plan
- Use VEX without losing vulnerability evidence
Running a PSIRT and publishing advisories
- Set up a PSIRT: services, intake, triage, SLAs and the CNA role
- Publish security advisories with CSAF, VEX, CVE records and OSV
- Respond to product security incidents: plan, tabletop and postmortem
- Run coordinated vulnerability disclosure from report to advisory
- Use VEX without losing vulnerability evidence
- Case study: Storm-0558 and the forged Microsoft tokens (2023)
- Staged rollout and rollback for security-critical updates
- Match an advisory to the actual package and deployed behavior.
- Set urgency from exploitation evidence and exposure, and test containment against the vulnerable path.
- Keep candidate repair, rollout, customer communication and verified closure separate.
An advisory-to-deployment exposure record with VEX statuses, a tested containment proposal and a rollout-aware recovery decision.
- Distinguish dependency coordinates, resolved versions and deployed artifacts.
- Use the connected advisory dossier; real containment must follow the authorized incident process.
Create an advisory record with original source, ecosystem and package identity, affected range, fixed release, vulnerable operation and publication or revision time. Add the CVSS v4.0 vector, the EPSS probability and whether the CVE is in CISA’s KEV catalog; they set urgency, not exposure. Compare the advisory to the exact installed coordinates before assigning exposure, and keep conflicting vendor or distribution evidence for review. Finish when a same-name package or an outdated version label cannot silently decide the match, and missing advisory facts remain explicit.
Join the record to deployed artifact identities, configuration and the path that reaches the vulnerable operation. Trace attacker-controlled input, execution privilege and affected assets. Separate confirmed reachability, a bounded non-reachability argument and unknown coverage. Finish with an exposure table whose rows explain the evidence for each service, and a VEX status for each product (affected, not affected with a justification, fixed or under investigation), rather than treating package presence as either certain exploitation or harmlessness.
Assign incident and delivery owners, then compare a temporary control with the actual attack path: disabling a page does not block a still-active API or queued job. Record the control’s test, expiry, product cost and rollback plan, and preserve evidence before replacing systems. If you manufacture a product sold in the EU and the vulnerability is actively exploited in it, the Cyber Resilience Act clock started at awareness: an early warning within 24 hours and a notification within 72 hours through ENISA’s Single Reporting Platform. Finish when containment has an observable boundary and patch readiness is not confused with deployment.
Compare the candidate with every affected running instance and retest legitimate behavior plus the vulnerable operation. Calculate rollout coverage from the affected population; a partial fleet update stays open. Retire temporary controls only when the replacement is verified. Publish what customers need, such as an advisory in CSAF and VEX statements for products that are not affected, through the established communication channels and authority. Produce a timeline, an impact and uncertainty statement and one owned prevention action; completing this worksheet does not send any notification.
To build the skills behind this job step by step, follow the learning path From source to trusted release.
Use the blank work product for your system. Compare its required evidence with a completed synthetic example.
Download blank work product Download completed example