When a vendor says its product is affected, find every place you run it by combining your asset inventory, procurement and licence records, cloud and container inventories, network or endpoint listings, and any SBOMs you hold for that vendor. Then match versions to the vendor's affected range and rank by exposure.
Start with the vendor's exact words
Read the vendor notice for the product name, the affected versions, the fixed version and any mitigation. The CISA minimum requirements for VEX define the status values a vendor should use, such as affected, fixed and under investigation, so check which one the vendor chose for which product. If a vendor says under investigation, that is not a clearance.
Where to look
| Source | What it shows | Blind spot |
|---|---|---|
| Asset or CMDB records | Systems and owners | Out of date entries |
| Procurement and licence records | What you bought and from whom | Shadow or free trial use |
| Cloud and container inventories | Running workloads and images | Short lived or untagged workloads |
| Vendor SBOMs you hold | Components inside the vendor product | Only as current as the file |
| Network or endpoint listings | Installed software and open services | Coverage gaps |
| Team surveys | Tools the inventory misses | Slow and incomplete |
No single source is complete. Use several and merge by product name and version.
Steps
- Normalise the product name, since vendors rename products and teams use nicknames.
- Query each source above and gather system, version and owner.
- Merge the lists and remove duplicates.
- Compare each version with the vendor's affected range.
- Mark exposure: internet facing, internal only, or holding sensitive data.
- Assign an owner per system, and record anything you could not check.
- Apply the vendor's fix or mitigation in exposure order.
The same approach works for a component inside a vendor product. If you hold the vendor's SBOM, use it to check whether the named component is present, as described in linking a supplier SBOM to the products you run.
Ask the vendor for what you cannot see
If the notice leaves gaps, send a short message with your product and version asking for status, a fix path and an updated SBOM or VEX statement. The post on what to ask a supplier first has a template.
Record the result
Keep the list of systems, versions, owners and actions in the incident file, and note the sources you checked. If a system could not be confirmed, say so, and set a date to check again.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a new advisory is tied to the software you run.
Quick check
What if the vendor has not published affected versions?
Treat every version you run as potentially affected, apply any mitigation offered, and ask the vendor for a version range.
How do we find shadow installs?
Combine endpoint and network listings with a short survey of teams, and record what stays unconfirmed.
Safeguard's asset discovery and zero-day discovery can help show where affected software runs in your environment.
Sources
Last reviewed: 19 October 2026.
