Reply within minutes with an honest holding answer: you are checking, you will report by a stated time. Then check whether you run the component, whether it is exposed, and whether it is being exploited, and send a dated status. Do not answer "no" from memory.
First reply, in minutes
Seen it. We are checking whether we run the affected component. I will send a status by [time], earlier if it is serious.
That reply does three things: confirms awareness, sets expectation, and commits to a time. It also stops the executive from forwarding the link to five other people.
The checks, in order
- Do we run it? Check the component inventory. If you maintain SBOMs, search them. CISA describes an SBOM as a nested inventory of software components (CISA), which is built for this lookup.
- Which products and versions? Include indirect dependencies, since the flaw is often several layers down.
- Is it exposed? Internet-facing, internal, or not deployed.
- Is the vulnerable code reachable? If the function is never called, the practical risk differs.
- Is it exploited? Check CISA's Known Exploited Vulnerabilities catalog, which lists vulnerabilities known to be exploited in the wild (CISA). Note the time you checked.
The status reply
Use a fixed shape:
| Line | Example |
|---|---|
| Status | Affected, mitigation in progress |
| Where | Two services, one internet-facing |
| Exploited | Not listed as of 11:20 |
| Actions | Upgrade tonight, edge filter now |
| Next update | 17:00 |
If the answer is "not affected," include the reason. "We do not use the vulnerable feature" is a reason. "We think it is fine" is not.
If you cannot answer quickly
Then the finding is about your inventory, not about the news item. Say so: "We could not confirm in the time we expected because component inventory for the legacy services is incomplete. Owner and date for fixing that: ..." This is uncomfortable and still better than a guess.
What executives usually ask next
- Do customers need to know? That decision belongs to legal and security together.
- Are competitors affected? Do not speculate.
- Can this happen to us again? Describe the inventory and monitoring you rely on, truthfully.
After the day
Write two lines in a log: how long the check took, and what slowed it. If the check took more than a few hours, inventory is the next project. Review the news items from the past quarter and test whether you could have answered each within the hour.
Try it yourself
Click through it at your own pace, or open it full screen. Click through the inventory and try finding a package by name. That lookup is step one of every news-driven check.
Where Safeguard fits
Safeguard provides dependency scanning, SBOMs and zero-day discovery, which shorten step one. The free scan is at gold.safeguard.sh/scan.
Quick check
Is it acceptable to say we are checking?
Yes, if you add a time for the next update.
What if we cannot find the component?
Report that no match was found in the inventory as of a time, and note any gaps in inventory coverage.
Sources
Last reviewed: 19 October 2026.
