The supplier is best placed to say whether their own product is affected, because they know the build and the code. But CISA says VEX can be authored by the supplier or a third party, and you can also write VEX about your own deployment. Choose the author by who has the evidence, then record who it was.
What the requirements allow
CISA's minimum requirements say VEX documents can be authored by the supplier of the software or by a third party. Authors may be an individual or an organization, and the author is responsible for the content. The author role may use the CSAF publisher categories: coordinator, discoverer, other, translator, user and vendor.
That list matters. "User" is a valid role, so a customer can publish VEX about how a product behaves in their environment.
Three authoring situations
Supplier writes about their product. Best for questions about build configuration, whether the code is present, and whether a fix exists. Consumers get the most reliable answer on those points.
Consumer writes about their deployment. Best for questions the supplier cannot answer: is the vulnerable feature enabled here, is the service exposed, does our configuration avoid the condition. This is internal VEX, and it often never leaves the company.
Third party writes about a product they analysed. A researcher, a distributor or a coordinator can publish findings. Treat it with the same scrutiny as any other claim, and check the author role and identity.
A decision table
| Question | Best author |
|---|---|
| Is the component in the build? | Supplier |
| Is the code compiled in? | Supplier |
| Is the function called by the product? | Supplier |
| Is the feature enabled in our deployment? | Consumer |
| Is the service reachable from outside? | Consumer |
| Has an independent party reproduced the issue? | Third party |
Keep supplier and internal VEX apart
If you write your own statements about a supplier's product, do not overwrite theirs. Keep them as a separate document with your name as author. That way, an auditor can see whose claim a decision rests on.
Identity and namespacing
CISA says statement identifiers should use the author as a namespace. If you publish internal VEX, pick a stable author name, for example your company name, and keep document IDs consistent under it.
When to avoid authoring
If you cannot explain the evidence in a sentence, do not publish a not_affected statement. Use under_investigation and say so.
Quick check
Can a customer write VEX about a vendor's product?
CISA permits third party authors, and the user role exists in the author role list. Say clearly that it is your analysis and not the vendor's.
Sources
Last reviewed: 19 October 2026.
