Give the advisory feeds to a named reader each week, with a backup and a written source list. A rotating intake role keeps feeds read, spreads the knowledge and stops one person becoming a single point of failure. The reader triages, hands off and records what was decided.
Why feeds go unread
Feeds are easy to subscribe to and hard to keep reading. A shared mailbox that everyone can see is a mailbox nobody checks. The pattern is familiar: the owner goes on leave, the mailbox grows, and a critical notice sits for weeks. The fix is not more tooling. It is a named person, a time slot and a place to record outcomes.
Build the source list
Start from what you run, not from what exists. For each product, record the official source and how it delivers notices.
| Source type | Example delivery | Cadence |
|---|---|---|
| Operating system vendors | Mailing list, Atom or RSS (Ubuntu), debian-security-announce and RSS (Debian) | Rolling |
| Monthly vendor patch days | Published release notes (Microsoft, SAP) | Second Tuesday |
| Quarterly or cycle based vendors | Advisory pages with pre-release notice (Oracle) | Third Tuesday of set months |
| Open source package ecosystems | Dependabot alerts, OSV data | On discovery |
| Government alerts | CISA Alerts and Advisories, Known Exploited Vulnerabilities catalog | As published |
Keep the list to what you run. A long list guarantees nothing is read.
Define the role
A reader for the week does five things.
- Reads every source on the list at least once on set days, for instance Monday, Wednesday and Friday, plus a check after each vendor patch day.
- Triages new items with the same short checklist, such as the five questions in our ten minute advisory triage.
- Opens a ticket for anything that applies, with an owner and a date.
- Posts a short note in the team channel on Friday: what arrived, what applies, what was decided.
- Hands off to the next reader with open items and any unusual notes.
The backup covers leave and sickness and takes over if an item is marked urgent.
Set the rules for urgency
Write down what interrupts the rota. For example: a match against the CISA Known Exploited Vulnerabilities catalog, a vendor out-of-band release, or a notice for an internet-facing product. These go to the on-call owner at once, whoever is the reader that week. Agree this with the on-call team before it is needed.
Keep the handoff note short
A good handoff has four lines: items still open and their dates, sources that were noisy, sources that missed something, and one thing the next reader should watch. Over a quarter, those notes show which sources earn their place and which do not.
Review quarterly
Every three months, check each source against the vendor's own page for changes in cadence. Oracle, for example, added a Critical Security Patch Update cycle in 2026 beside its quarterly one, and a source list written earlier would not mention it. Remove sources for products you retired and add the ones you acquired.
Measure lightly
Two numbers are enough: how long a new applicable advisory takes to reach a ticket, and how many applicable items were found by someone other than the reader. The second number should fall over time.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch how monitoring surfaces new items on its own, and think about which of your sources could feed the same view instead of an inbox.
Safeguard's asset discovery and dependency scanning keep the inventory current, and policies can route findings to owners. A free scan is an easy place to start.
Quick check
How many people should be on the rota?
Enough that nobody reads feeds more than about one week in four. A pair per week, reader and backup, is a common pattern.
Should the rota read every source daily?
Not necessarily. Rolling sources may need three set checks a week, plus a check after each monthly or quarterly patch day.
Sources
- Ubuntu, Security notices
- Debian, Security information
- Microsoft Learn, Update release cycle for Windows clients
- SAP, SAP Security Notes and News
- Oracle, Security Alerts and Critical Patch Updates
- CISA, Cybersecurity Alerts and Advisories
Last reviewed: 19 October 2026.
