Run a 30 minute tabletop by picking a past public advisory, giving the team only what they would have had on day one, and timing how long it takes to match it to products, assign statuses, draft a customer notice and a VEX statement. Write down every step that stalled.
Why drill
Response plans fail at handoffs: who owns the index, who can approve a statement, who has the customer list. A drill finds those in a calm half hour instead of on a bad day. It also checks whether your SBOMs are complete enough to answer.
Before you start
- Pick an advisory in a component you ship, already public, with a clear fixed version.
- Print the advisory text only. Do not give hints.
- Name a facilitator, a timekeeper and a note taker.
- Invite security, one engineer per major product, support and communications.
Agenda
| Minutes | Step | Question to answer |
|---|---|---|
| 0 to 3 | Brief | Here is the advisory, the clock starts now |
| 3 to 10 | Match | Which products and releases contain the component? |
| 10 to 17 | Triage | For each hit, what status, and on what evidence? |
| 17 to 22 | Notify | Who do we tell first, and what do we say? |
| 22 to 27 | Publish | Draft the VEX and advisory fields |
| 27 to 30 | Debrief | What stalled? What do we change? |
Scoring
Give one point for each of these.
- The match was a query, not a manual search.
- Every hit received one of the four statuses.
- Each not affected claim had a reason a reviewer could check.
- The customer list was available within the time.
- A named person could approve publication.
- The draft VEX passed a format check, such as the required fields in the OpenVEX specification.
A score of six means the process worked on paper. Anything lower tells you where to spend the next sprint.
Common findings
- Release SBOMs exist for some products but not for old supported releases.
- Nobody knows which customers run which version.
- The person who can approve a public statement is on leave, with no backup.
- Triage depends on one engineer's memory.
- Statuses are written in free text, not in the four standard words.
After the drill
- Turn each finding into a ticket with an owner and date.
- Repeat the drill with a different advisory in a quarter.
- Compare times. The aim is a visible trend, not a perfect score.
For a deeper look at the match step, see build a component to release index.
Quick check
Should we use a real incident?
Use a real public advisory from the past, not a live one. Then nobody is pulled from actual work.
Who must attend?
At least one person who can decide on product status, one who can contact customers, and one who can approve a public statement.
Safeguard's SBOM and dependency scanning and asset discovery can give you the inventory to drill against. A free scan is available.
Sources
Last reviewed: 19 October 2026.
