Read the vendor's public advisories for the product you plan to buy. For each flaw, note the report date, fix date and disclosure date, work out the gaps, and check whether any were on a known exploited list. A pattern across a dozen advisories tells you more than a sales claim.
What you need
Three sources, all public:
- The vendor's security advisory page for the product.
- The CVE records those advisories reference.
- The CISA Known Exploited Vulnerabilities catalog, which CISA describes as the authoritative source of vulnerabilities exploited in the wild.
If the vendor has no advisory page, that is a finding in itself. CISA's Secure by Demand guide asks whether manufacturers file timely and correct CVE records and publish a vulnerability disclosure policy.
Steps
- List every advisory for the product line from the last two to three years. Include all versions.
- For each, record: disclosure date, fix release date, affected versions, fixed versions and severity.
- Where the advisory states when the vendor was told, record that too. Many do not, and the absence is worth noting.
- Compute two gaps: report to fix when known, and disclosure to fix.
- Check each CVE against the exploited list. Mark any that appear.
- Look for flaws that were fixed in a newer version only, with no fix for the older line you would run.
- Note repeats: the same class of flaw appearing again and again suggests the root cause was never addressed. Secure by Demand asks which vulnerability classes the manufacturer has systematically addressed.
A simple sheet
| Advisory | Disclosed | Fixed | Gap | Exploited list | Older line fixed |
|---|---|---|---|---|---|
| Entry one | date | date | days | yes or no | yes or no |
Fill it for at least ten entries if the vendor has that many. Fewer entries mean less evidence, not good news.
How to read the result
- Fix before or at disclosure: coordinated handling, a good sign.
- Long gaps for high severity flaws: ask for the reason.
- Fix dates missing: the advisory is not auditable. Ask the vendor to supply them.
- Exploited flaws with slow fixes: serious. Ask what changed afterwards.
- Only the newest version patched: see our guide on how many versions back a vendor patches.
Be fair about limits. A large product has more advisories than a small one, and a count alone says little. A vendor with many quick, well documented fixes can be better than one with a short, silent list. What you are measuring is behavior, not volume.
Use it in negotiation
Show the vendor your sheet. Ask about the slowest entries. A confident vendor explains. Then base your patch SLA on what the vendor has actually done, with margin. Our guides on defining critical and the clock start help with wording.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how time to fix is tracked per finding.
Quick check
What if the vendor publishes no advisories?
Treat it as a finding. Ask how customers learn about flaws and whether a disclosure policy exists.
Does a long advisory list mean a bad vendor?
Not by itself. Look at gaps, repeats and whether exploited flaws were fixed quickly.
Safeguard users can apply the same discipline to their own estate through vulnerability tracking, policies and gates.
Sources
Last reviewed: 19 October 2026.
