A good first 24 hours has four phases: confirm the advisory and open an incident record, search your SBOM inventory, assign verdicts product by product, then tell customers what you know and what you do not. Speed comes from preparation, so the steps below assume SBOMs are already stored.
The timeline
| Window | Goal | Output |
|---|---|---|
| Hour 0 to 1 | Confirm the report and name an owner | Incident record, one lead, one scribe |
| Hour 1 to 4 | Search all stored SBOMs for the component | Hit list plus an "unknown" list |
| Hour 4 to 12 | Verdict per product and release | Affected, not affected, or under investigation |
| Hour 12 to 18 | Draft the customer notice and the first VEX statements | Notice reviewed by the approver |
| Hour 18 to 24 | Send, then schedule the next update | Published notice and a dated follow-up |
These windows are a planning aid, not a standard. Scale them to the severity and to your team size.
Hour 0 to 1: confirm and organise
Read the advisory itself, not a summary. Note the component identity, the affected versions and whether a fix exists. Open one incident record and give it a name and a time. Decide who leads, who writes things down and who approves outward messages. If you have no roles defined, the related post on small team incident roles covers it.
Hour 1 to 4: search
Query stored SBOMs by package URL, as described in finding every product that ships a vulnerable component. Produce two lists: hits, and products with no usable SBOM. The second list is as important as the first.
Hour 4 to 12: verdicts
For each hit, answer three questions. Is the version in the affected range? Is the vulnerable code present in the shipped artifact? Is it reachable in your product's use? Record each answer with evidence. Use under_investigation freely at this stage. The CISA minimum requirements for VEX describe it as a status that is expected to change once the investigation concludes.
Hour 12 to 24: communicate
Write the customer notice from facts you have verified. Say what you know, what you are still checking and when you will update. Avoid guessing about cause or attacker. Publish first VEX statements for products with a settled verdict and mark the others as under investigation. Put the next update time in the notice and keep it.
What usually slips
Teams tend to skip the unknown list, forget to record negative results, and promise updates they do not schedule. A short checklist taped to the incident record fixes most of that.
Try it yourself
Click through it at your own pace, or open it full screen. Watch how findings move from detected to triaged to resolved.
Quick check
Do we need a VEX before notifying customers?
No. You can send a notice with some products marked under investigation and follow up as verdicts settle.
Who approves the customer notice?
Decide this before an incident. Many teams use a security lead plus a communications or legal reviewer.
Safeguard's vulnerability management and SBOM tooling can hold the inventory and findings in one place, which shortens the search phase.
Sources
Last reviewed: 19 October 2026.
