(Note: I work in this "supply chain security" space.) Until VEX[0] is further along, I worry about the utility of an approach like simply publishing an SBOM fo

(Note: I work in this "supply chain security" space.) Until VEX[0] is further along, I worry about the utility of an approach like simply publishing an SBOM for every release. The presence of a package does not usually mean that there is an exploitable vulnerability[1]. Reality is that only 2-5% of reported vulnerabilities matter. VEX aims to provide an ability to say, "Yeah, we use that vulnerable library, but we don't call the vulnerable function." FedRAMP will help push this problem forward though because if you can't meet that certification, you can't sell to the government. And that includes any company in the "supply chain" that has customers that sell to the government too. It's definitely going to be noisy as hell though! "Operational Visibility - Monthly reporting on all vulnerability scans, an up to date POA&M, and an up to date inventory - High risks must be fixed in 30 days, Moderate in 90; and low as possible"[2] 0: https://www.lunasec.io/docs/blog/vex-silence-false-positives/ https://www.lunasec.io/docs/blog/vex-silence-false-positives... 1: https://www.lunasec.io/docs/blog/the-issue-with-vuln-scanners/ https://www.lunasec.io/docs/blog/the-issue-with-vuln-scanner... 2: https://www.fedramp.gov/assets/resources/training/200-D-FedRAMP-Training-Continuous-Monitoring-ConMon-Overview.pdf https://www.fedramp.gov/assets/resources/training/200-D-FedR...