Send the customer notice first in most cases, and mark unsettled products as under investigation. A VEX document is a good follow-up, not a prerequisite. Wait only when sending would give customers wrong or unverified information, or when a coordinated disclosure date constrains you.
What VEX does and does not require
The CISA minimum requirements say VEX is designed to integrate with SBOMs, vulnerability databases and advisories, but does not require any of them. Its statements declare a single status for one vulnerability across one or more products, and the status values are not affected, affected, fixed and under investigation. The document also says under investigation means the author has not yet declared a final status, and that it is expected to change.
That last point answers the question. The format itself has a status for "we do not know yet", so there is no need to hold back until everything is known.
A simple decision path
- Is the vulnerability public, or about to be? If yes, customers will start scanning and asking. Prefer sending early.
- Do you have at least one verified fact customers can act on, such as a fixed version or a mitigation? Send.
- Is your list of affected products still unknown? Send a short notice saying you are investigating, with a time for the next update.
- Is there a coordinated disclosure embargo? Follow the agreed date and keep to the agreed wording.
- Are you tempted to send because of pressure rather than facts? Slow down. State only what you can back up.
Comparing the two approaches
| Approach | Strength | Risk |
|---|---|---|
| Notice first, VEX after | Customers get information early and can start their own checks | Needs discipline to follow up on schedule |
| Wait for a full VEX | One complete, tidy message | Customers fill the silence with their own guesses and support tickets |
| Notice plus partial VEX | Settled products get machine-readable answers right away | More documents to keep consistent |
Keep the follow-up promise
If you send early, the follow-up is the real work. Put a time for the next update in the first notice. When verdicts settle, publish VEX statements and update the document. The CISA text says timestamps and versions exist to support change notification and tracking, so use them rather than silently replacing files. The related post on what to send in a VEX follow-up covers the cadence.
What not to do
Do not mark a product not affected to look tidy. Do not remove the under investigation line without a reason recorded. Do not send different facts to different customers.
Quick check
Can a notice stand without any VEX?
Yes. VEX does not require a notice or an SBOM, and a notice does not require VEX.
What if we are not sure whether we are affected?
Say so, mark the product under investigation, and give a time for the next update.
Safeguard's SBOM and reachability tooling can speed the verdicts that turn an early notice into a complete answer.
Sources
Last reviewed: 19 October 2026.
