In the first 24 hours, do five things in order: confirm which products contain the affected version, check whether the vulnerable code is reachable, apply a mitigation if no fix exists, tell the people who need to know, and record every decision. Speed comes from having an inventory before the news breaks.
Timeline
| Window | Goal | Output |
|---|---|---|
| Hour 0 to 1 | Confirm the report is credible and name an incident owner | Owner, shared channel, source links |
| Hour 1 to 4 | Find exposure | List of products and versions containing the package |
| Hour 4 to 8 | Check reachability and exposure paths | Which are internet facing, which call the code |
| Hour 8 to 16 | Mitigate or patch | Mitigation in place or fixed version in test |
| Hour 16 to 24 | Communicate and record | Status note, decision log, follow up list |
Step by step
- Confirm. Read the primary source, such as the maintainer's advisory. Check whether the flaw is on the CISA Known Exploited Vulnerabilities list, which raises urgency.
- Name an owner. One person coordinates. Others do the work. Without this, three teams duplicate effort.
- Query your inventory. Search stored SBOMs for the package and affected range. Include container images and old releases still deployed.
- Rank exposure. Internet facing first, then internal systems holding sensitive data.
- Check reachability. If your code never calls the vulnerable function, the case for emergency action weakens, but keep it on the list.
- Mitigate. When no fix exists: disable the feature, block the route at the edge, restrict access, or pin to an unaffected version.
- Patch when a fix lands. Test in a branch, deploy in stages, and watch error rates.
- Communicate. Tell leadership and support what is affected and what is not. If customers are exposed, follow your notification process.
- Record. Keep the timeline, decisions and evidence. You will need them for review and for auditors.
What to avoid
- Waiting for a CVE ID before starting. Work from the advisory.
- Treating unreachable as not affected, without writing down why.
- Patching production in one step with no staged rollout.
- Closing the incident without a follow up on the inventory gaps you found.
Try it yourself
Open the demo and watch how a new advisory is matched to an inventory. Notice how fast the affected list appears when components are already recorded.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard offers zero-day discovery, SBOM and dependency scanning for the exposure list, and reachability analysis for the callable check. A free scan shows what your inventory looks like.
Quick check
Should I take a service offline?
Only if it is exposed, reachable and no mitigation is available. Often a block at the edge or a disabled feature is enough.
Who needs to be told?
At minimum, product owners and support. If customer data may be affected, follow your notification obligations with legal and privacy input.
Sources
- CISA Known Exploited Vulnerabilities Catalog (list of vulnerabilities exploited in the wild).
Last reviewed: 19 October 2026.
