Trust a supplier's VEX statements to the degree you can verify them. A VEX file is the author's claim about their own product. It is useful and often accurate, but the standards put responsibility on the author and give consumers no guarantee of correctness. Verify identity first, then sample the evidence, then watch consistency over time.
The author owns the claim
CISA's minimum requirements say the author of a VEX document is responsible for its content. They also say VEX information may be incomplete, and that the document does not represent a mandate or consensus standard. So a statement is only as good as the people who wrote it and the process behind it.
Test 1: identity
The requirements say authors should identify themselves cryptographically with digital signatures and the author field. Ask whether you can tie the file to the supplier. A signature or a trusted delivery channel answers this. A file emailed as an attachment from an unknown address does not.
Test 2: kind of evidence
Not every justification is equally checkable. Component absent and code not built are verifiable from artifacts. Execute path claims depend on analysis. Two values, cannot be controlled by an adversary and inline mitigations, are described by OpenVEX as hard to prove conclusively.
Ask which justification a supplier uses most. A file where nearly every statement relies on the two hardest to prove values deserves a conversation.
Test 3: consistency with your own data
Compare the supplier's claims with what you can observe. If an SBOM shows the component is present and the supplier says component_not_present, one of you is wrong. Disagreements are normal. They are also the best signal about reliability.
Test 4: update behaviour
A healthy supplier increments the document version when anything changes and moves statements from under_investigation to a final status. A file that never changes while new CVEs appear is either not maintained or not being published.
Test 5: willingness to explain
Ask for the reasoning behind two statements. Suppliers who do the analysis can answer in a paragraph. Those who generated statements blindly cannot.
What trust looks like in practice
| Evidence | Trust level |
|---|---|
| Signed, versioned, with justifications and notes | Higher |
| Signed, justification only | Medium |
| Unsigned, prose only | Lower, verify each item |
Treat higher trust as permission to reduce triage effort, not to stop watching. Keep a review date on every accepted not_affected statement.
Quick check
If a supplier says not_affected, can I close the finding?
You can once you accept the reasoning and record the source. Keep the document reference in the ticket so the decision is auditable.
Who is liable if a VEX statement is wrong?
The standards do not address liability. CISA says its document does not impose or mandate compliance. Check your contract with the supplier.
Sources
Last reviewed: 19 October 2026.
