A useful dependency review takes about fifteen minutes a week if you split it. Do a five minute scan each morning for new critical findings, and a ten minute weekly pass for trends, stale projects and decisions that need recording.
The daily check, five minutes
Open your security tool of choice, such as Safeguard Desktop, and ask three things.
- Is there any new critical or known exploited finding since yesterday?
- Did any scan fail or go stale?
- Did a dependency update merge overnight that I did not expect?
If the answer to the first is no, you are done. If yes, open the details, check whether a fixed version exists, and add it to the day's work or flag it to the owner. Daily checks are not for deep investigation.
The weekly review, ten minutes
- Which projects have the most open high findings? Pick one to reduce.
- Which projects were not scanned this week? Find out why.
- Which accepted risks expire soon? Re-decide them.
- What changed in the SBOM of your busiest repository?
- Which question did you answer by hand more than once? Script it.
Keep the output of the weekly review to three lines: what you fixed, what you deferred and why, and what you will check next week.
Use the right filters
Sort by exploitation signals first. CISA's Known Exploited Vulnerabilities catalog is maintained as the authoritative source for vulnerabilities exploited in the wild, and EPSS publishes daily scores estimating exploitation within 30 days. Both are free. See the post on prioritising with KEV, EPSS and reachability.
Record decisions
A short log beats good memory. Each entry needs a date, the finding, the decision and a review date. If you accept a risk, give it an expiry so it returns to the list instead of vanishing.
Make it a shared habit
One person doing this alone becomes a single point of failure. Rotate the weekly review between two or three people, and keep the log in a shared place. When someone is away, the routine should still run.
Common ways it fails
It grows. Fifteen minutes becomes an hour because every finding gets investigated on the spot. Keep investigation to separate, scheduled work.
It becomes noise. If most days show nothing actionable, people stop looking. Tune the filters until a day with a flag is a real day.
It has no owner. Every project needs a named person who is told when a critical finding appears.
Where Safeguard fits
Safeguard Desktop gives you a native window for the daily and weekly questions, while the CLI can run the same checks unattended. The free scan at gold.safeguard.sh/scan works for a quick look at a manifest.
Quick check
How long should a daily check take?
About five minutes. Anything deeper belongs in scheduled work.
What should the weekly review produce?
Three lines: what was fixed, what was deferred and why, and what to check next.
Sources
- CISA Known Exploited Vulnerabilities Catalog
- FIRST, Exploit Prediction Scoring System
- Safeguard download page
- Safeguard free scan
Last reviewed: 19 October 2026.
