Pull vulnerability data on a connected machine, verify and record it, move it across your boundary by an approved path, import it into your scanner, and track the data's age. Agree a staleness budget with your security lead, and alert when the age exceeds it.
The problem
A scanner that cannot reach the internet cannot learn about new advisories on its own. Without a process, its data ages quietly while its results still look authoritative. Open source tools often support importing data from a file or a mirror, and managed platforms may offer an on premises or offline option. Either way, the update path is your responsibility to design and verify. Our general guide on air-gapped vulnerability management covers the wider picture, and this post focuses on the refresh routine.
What public sources offer
OSV's documentation says the full database can be downloaded from a Google Cloud Storage bucket, and describes a modified_id.csv file that lists added or changed records, so you can fetch only what changed. CISA publishes the KEV catalog in CSV and JSON, and FIRST publishes EPSS scores as a daily CSV. These are practical building blocks for an offline refresh.
The runbook
- Set a staleness budget. Decide the maximum age of data you accept, by environment. A budget of days is a different design from a budget of weeks.
- Pull on a connected host. Download full data once, then incremental changes using the changed record list. Also fetch the KEV and EPSS files.
- Record and hash. Save a manifest with source, retrieval time and a checksum of each file.
- Scan the media. Apply the same malware and integrity checks you use for any inbound transfer.
- Transfer by the approved path. Follow your boundary policy, with two person approval if your rules need it.
- Import. Load into the internal mirror or the scanner, and log the import time.
- Verify. Scan a known test project that has a recently published advisory and confirm the finding appears.
- Publish the age. Expose "data as of" in every scan report so readers can judge results.
Measuring staleness
| Measure | How |
|---|---|
| Data age | Now minus the retrieval time in the manifest |
| Import lag | Import time minus retrieval time |
| Budget breaches | Count of days over budget per quarter |
| Verification result | Pass or fail of the test advisory |
Choosing open source or managed here
Open source tooling gives you full control and full responsibility. A managed offering for restricted networks should answer clearly: how are updates delivered, how are they verified, how often, and what does the product show about data age? Put those in writing during evaluation. Be careful with any claim that it "just works" offline.
Safeguard is a managed platform, and its free scan at gold.safeguard.sh/scan is a web scan you can use for comparison testing before deployment decisions.
Quick check
Is an annual data refresh acceptable?
That is a risk decision for your security lead. New advisories appear daily, so a long gap means long blindness. Set a budget and measure against it.
Do I need KEV and EPSS offline too?
They are optional for detection but helpful for prioritisation. Both are available as downloadable files.
Sources
Last reviewed: 19 October 2026.
