Publish the format your customers' tools already read, and that your existing process can produce. CISA names CSAF, CycloneDX and OpenVEX as formats that can contain or generate VEX. If you already publish advisories, use CSAF. If you ship CycloneDX SBOMs, consider CycloneDX. For a minimal standalone file, OpenVEX.
What the three formats are
CISA's minimum requirements say that CSAF, CycloneDX and OpenVEX can contain or be used to generate VEX documents, and that CSAF and CycloneDX provide information beyond what VEX requires. The requirements are format independent, so any of them can satisfy the same minimum elements.
How they differ in practice
| Format | Shape | VEX specifics from the sources |
|---|---|---|
| CSAF 2.0 | Security advisory framework in JSON | A VEX document uses the category csaf_vex. Each known_not_affected product needs an impact statement, and each known_affected product needs an action statement |
| CycloneDX | Bill of materials standard that can also carry VEX | Can contain VEX content alongside inventory data |
| OpenVEX | Small purpose built VEX format | Four statuses, justification labels, purl preferred as a product identifier, document and statement versions |
OpenVEX's spec lists the same four statuses CISA names (not_affected, affected, fixed, under_investigation) and the same five justification labels. A not-affected statement needs a justification or an impact statement.
A decision guide
- List what your customers have asked for in writing. Their tooling is the deciding factor.
- Check what you already publish. A team with a CSAF advisory process gets VEX nearly free by using the VEX profile.
- Check how you ship SBOMs. If you already produce one format, keeping VEX in the same family reduces mapping errors.
- If you have no advisory process, a small standalone format has the lowest setup cost.
- Keep one internal source of truth for statuses and render to formats from it, so you never edit three files by hand.
What to avoid
Do not publish the same statement in two formats with different wording. Generate both from one record. Also avoid free text where a label exists. The OpenVEX spec warns that free text impact statements break automation and interoperability, so prefer the justification label and add text only as a supplement.
Related: mapping CycloneDX analysis states to OpenVEX statuses.
Try it yourself
Open the demo and notice that the exploitability result is a status plus a reason. That pair is what every format encodes.
Click through it at your own pace, or open it full screen.
Quick check
Is one format more official than the others?
CISA's minimum requirements are format independent and name all three as able to carry VEX. None is singled out.
Can we publish more than one?
Yes, if they are generated from the same record and say the same thing.
Safeguard's reachability analysis and SBOM and dependency scanning give you evidence for the statuses, and the free scan is a way to start.
Sources
- Minimum Requirements for Vulnerability Exploitability eXchange (VEX), CISA, April 2023
- OpenVEX specification
- Common Security Advisory Framework Version 2.0 (OASIS Standard)
Last reviewed: 19 October 2026.
