Either works. CISA's minimum requirements say VEX statements must be able to exist without additional infrastructure, so a standalone document is valid, and statements may also inherit metadata from a containing advisory such as CSAF or CycloneDX. Embed when you already publish advisories. Go standalone when you only need status.
What the CISA text says
The minimum requirements state that VEX documents and statements must be able to exist without extra information infrastructure, meaning a VEX document does not have to be part of a vulnerability advisory. A statement may inherit or depend on metadata from a containing document, in which case the advisory must supply the VEX metadata the statement needs. It also says CSAF, CycloneDX and OpenVEX can contain or be used to generate VEX documents, and that CSAF and CycloneDX carry information beyond what VEX needs.
Comparing the two approaches
| Question | Embedded in an advisory | Standalone |
|---|---|---|
| Extra content | Advisory text, scoring, remediation detail | Only status, product, vulnerability |
| Metadata | Inherited from the advisory | Carried in the VEX document |
| Best when | You already publish advisories for the issue | You only want to tell customers where they stand |
| Risk | Statements can be hard to extract by tools that expect plain VEX | Customers may miss context an advisory would give |
Keep metadata consistent
If a statement is separated from its original document, CISA says a new VEX document must be created and must copy the appropriate metadata from the original. Also, if one of many statements changes, the document version and last-updated time must change. In practice, this means your tooling should always write a complete document, never patch a statement in place and leave the document metadata stale.
A decision rule
- Is there already an advisory for this vulnerability that customers read? Put VEX status inside it.
- Is the vulnerability only in a third party component, with no advisory from you? Publish a standalone VEX that names your product and the component.
- Do customer tools ingest a particular format? Match that format.
Try it yourself
Open the demo and look at how a component's exploitability is stated on its own. That single statement is what a standalone VEX carries.
Click through it at your own pace, or open it full screen.
Quick check
Is a VEX document an advisory?
Not necessarily. CISA says it does not have to be part of one.
Do embedded statements need their own versions?
CISA says each statement must carry a version and timestamps, and the document version must move whenever anything inside changes.
Safeguard's reachability analysis supplies the evidence behind a not-affected call, and the free scan shows a first pass on your own dependencies.
Sources
Last reviewed: 19 October 2026.
