A workable VEX triage loop has five steps: collect findings, match supplier VEX by identifier, accept or challenge each not_affected claim, record the decision with the document reference, and re-open findings when a newer document version changes a status. The loop is small enough for one engineer to run weekly.
Step 1: collect findings and an SBOM
Run your scanner and keep the component list. Identifiers in the SBOM are what you will match against. Without them, VEX application is manual.
Step 2: gather VEX documents
Fetch the latest from each supplier whose components appear in your findings. Check authorship and signatures first. CISA says authors should identify themselves cryptographically, and that HTTPS may suffice only if you trust the chain and the identity. Record the document identifier and version for each fetch.
Step 3: match statements to findings
For each finding, look for a statement with the same vulnerability and a product identifier matching your component. Remember that there is no default status. No statement means no answer.
Step 4: decide per status
- not_affected with a checkable justification such as component_not_present: accept, and sample verify.
- not_affected based on hard to prove values: read the impact statement, and challenge if thin.
- affected: follow the action statement, and set a due date.
- fixed: check your version, upgrade if needed.
- under_investigation: keep open, set a follow up.
Step 5: record the decision
Every closed finding should carry: the document ID, version, statement status, justification and the date you accepted it. If audited, this lets you show the basis for the decision.
Weekly re-run
On each run, compare the new document version with the stored one. If it is higher, diff the statements. Pay special attention to any move away from not_affected, and to under_investigation statements that reached a final status.
Handling your own analysis
Where the supplier is silent, you may write internal notes or your own VEX, with yourself as author. Keep them distinct from supplier statements.
Metrics worth tracking
- Findings closed by supplier VEX versus by your own analysis.
- Statements you challenged, and how many were changed.
- Time between a supplier document update and your processing of it.
Do not report "findings suppressed" as a success number on its own. It only counts if the claims were checked.
Click through it at your own pace, or open it full screen.
Quick check
How often should we refresh supplier VEX?
Match it to your scan cadence. Weekly is common for active products. The standards do not set an interval.
What if two sources disagree?
Keep the finding open, ask both authors for evidence, and record which statement you relied on.
Sources
Last reviewed: 19 October 2026.
