How VEX works in Safeguard

An SBOM lists what is inside a product. A VEX document says which of the known vulnerabilities in that list actually matter. Vulnerability Exploitability eXchange files let a supplier state, for a given product and CVE, that it is not affected, or affected, or fixed, or under investigation.

What Safeguard accepts

The CSAF and VEX upload page lists these formats, all as JSON:

How to upload

1. Open Integrations from the sidebar and filter by Upload.
2. Click Connect on the Upload CSAF/VEX card.
3. Enter a name, add an optional description, then drag in the file or click Browse. The file is validated automatically.
4. Set the project name and version, then click Upload.

The docs give two typical uses. One is importing vendor advisories so you can track vulnerabilities that affect your software. The other is managing status: marking a vulnerability not affected, documenting mitigation status, tracking exploitability assessments and reducing false positives in reports.

What a statement looks like

An OpenVEX statement names the vulnerability, the product by package URL, a status and a justification.

{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://example.com/vex/2024/001",
  "author": "Example Corp",
  "timestamp": "2024-01-15T00:00:00Z",
  "statements": [
    {
      "vulnerability": { "name": "CVE-2024-12345" },
      "products": [ { "@id": "pkg:npm/example-package@1.0.0" } ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present"
    }
  ]
}

This example comes from the Safeguard docs and uses a placeholder CVE.

What makes VEX usable

Safeguard has a CycloneDX VEX framework that checks seven requirements on each scan of a product, drawn from the CISA minimum requirements for VEX and the CycloneDX specification:

• Components carry package URLs so statements can be matched deterministically.
• Versions are declared, because status applies per product version.
• Versions are exact, not ranges, latest or wildcards.
• Hashes bind a statement to the exact artefact that was analysed.
• The BOM is in a machine-readable format such as CycloneDX or SPDX.
• The document identifies itself and carries timestamps.
• Each statement has an identified author.

The framework also lists controls for publishing VEX for disclosed vulnerabilities, justifying not affected status with evidence, tracking affected vulnerabilities through remediation, automating VEX generation in CI/CD, versioning and signing VEX documents, and distributing them to consumers. Treat the readiness score as Safeguard's assessment of what it can see, not as an audit result.

Related: sharing VEX

The July 2026 release notes mention downloadable SBOM, VEX and AI-BOM artifacts generated from your scans, shareable through the Trust Center.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• CSAF/VEX Upload, Safeguard Docs
• CycloneDX VEX framework, Safeguard Docs
• What's New, July 2026