Sales should say what the company knows, what it is still checking, and when the prospect will hear more, then route the technical detail to a named security contact. A rep who confirms "we are fine" without engineering sign-off puts the deal and the company's credibility at risk.
Why this question lands on sales
Buyers use news events as a test. A prospect who asks "are you affected by the thing in the news?" is often checking whether you have a process, not only whether you have the flaw. A calm, specific answer helps. A vague or overconfident one hurts.
Before the call: confirm four facts
Ask security or engineering for one paragraph covering:
- Current status for the product the prospect is evaluating (under investigation, not affected, affected with mitigation, fixed).
- When that status was last checked.
- Whether any customer action is needed.
- Who the prospect can talk to for technical detail.
If no paragraph exists yet, say so on the call. "Our security team is checking and I will send you their written update by end of day tomorrow" is a good answer.
What to say, in order
- Acknowledge the question as a fair one.
- State the current status in the words from the shared paragraph.
- Describe how you track new vulnerabilities, in general terms and only what is true: how the team learns about them, who decides, how customers are told.
- Offer the written statement and the security contact.
Claims to avoid
| Do not say | Say instead |
|---|---|
| We are not affected | Our security team's current status is not affected, last checked at a stated time |
| This does not matter | Here is why the team assessed it as it did |
| We have never had an incident | The wording legal and security approved in writing |
| We are certified against this | Avoid. A vulnerability is not a certification question |
Do not describe any compliance report as complete unless it is. If your SOC 2 report is in progress, say it is in progress.
Turn it into trust, not a pitch
Do not pivot to a feature list. If the prospect asked about a vulnerability, answer that, then ask what process they would want to see from a vendor. That question tells you what matters to their security team and often surfaces the real evaluation criteria.
After the call, log the question and your answer in the deal notes. If the same question comes from three prospects in a week, tell product marketing, because it belongs in a public statement.
When the answer changes
Status moves. If you told a prospect "under investigation," follow up when it changes, even if the news is good. A short note saying "now confirmed not affected, reason attached" builds more trust than the original answer did.
Try it yourself
Click through it at your own pace, or open it full screen. Click through the check and notice that being present in a product and being exploitable are different questions. Your answer to a prospect should keep them separate.
Where Safeguard fits
Safeguard can help here: the free scan at gold.safeguard.sh/scan lists the dependencies in a project and the known issues attached to them, and reachability analysis shows which findings your code can actually hit.
Quick check
Can a rep promise a fix date?
Only if engineering has committed to it in writing. Otherwise give the time of the next update, not a fix date.
What if the rep does not know the answer?
Say so, name the person who will find out, and give a time. That is a complete and credible answer.
Last reviewed: 19 October 2026.
