Match the test to the question the event raises. A new zero day calls for a fast dependency and exposure check. A major launch calls for a scoped pen test. A customer request calls for a report they can read. An incident calls for scoping, scanning and often a focused retest. The table below maps each trigger.
Decision table
| Trigger | The question | First test | Follow with |
|---|---|---|---|
| New zero day in a library you use | Do we ship it, and can it be reached? | Dependency scan against your SBOM, reachability check | External exposure check |
| Major feature or product launch | Did we create new ways in? | Scoped pen test of the new area | Regression scans |
| Authentication or access redesign | Can one user reach another's data? | Authenticated testing with two roles | Pen test of that area |
| Customer or auditor asks for evidence | What can we show? | Existing pen test report and scan history | New test if the report is stale |
| Move to a new cloud setup | What is exposed now? | External scan, configuration review | Pen test of key paths |
| Security incident | How did it happen, what else is open? | Scope the incident, scan affected systems | Focused retest after fixes |
| Acquisition or new codebase | What did we inherit? | SBOM and dependency scan, secrets scan | Pen test of the main product |
| Researcher reports an issue | Is it real, are there siblings? | Reproduce, then scan for the same pattern | Add a regression test |
How to use it
- Name the trigger and the question in one sentence.
- Choose the first test from the table, because it is quickest to answer.
- Decide in advance what result would send you to the follow up.
- Put owners and dates on each step.
- Record the outcome. It becomes evidence.
Speed matters for some triggers
For a new zero day, hours count. Dependency scanning against a stored SBOM answers the "do we ship it" question quickly. NIST SP 800-53 control RA-5 asks for scanning when new vulnerabilities affecting the system are reported, not only on a fixed timetable. See what a zero day vulnerability is for definitions.
For launches and redesigns, a pen test gives human depth, since NIST describes penetration testing as going beyond automated vulnerability scanning.
Try it yourself
Open the demo and watch how a newly announced zero day is matched against a project's components. Look at how quickly the affected projects appear.
Click through it at your own pace, or open it full screen.
Quick check
Do I need a pen test after every release?
No. Reserve full tests for major changes. Use automated scans on every release and a focused test for risky areas.
What is the fastest check after a zero day announcement?
Search your SBOM or dependency scan for the affected package and version, then check whether your code reaches the vulnerable path.
Safeguard supports the fast end of this table with zero day discovery, SBOM and dependency scanning, and reachability analysis. Try the free scan.
Sources
Last reviewed: 19 October 2026.
