Panel Discussion: Don’t be Vexed by VEX - VEXperts Panel
summary
Panel summarizes where VEX is actually used, what tools exist, and what still breaks: lightweight openVEX JSON‑LD statements and CAF/CSAF profiles are shipping, SPDX 3 RC2 and CycloneDX 1.7 add VEX support, and platforms like dependency‑track (used by 10,000+ organizations) ingest VEX. Producers can emit status (affected/not/under investigation) but consumption, distribution and validation tooling lags, issuance costs are real, and end‑to‑end automation is only partially working today.
AI-written summary · about
chapters (9)
- 0:00VEX introduction and panel
- 1:01What is VEX and why it matters
- 4:16VEX perspectives: dev, supplier, consumer
- 8:07VEX and existing standards
- 16:19CSAF vs CycloneDX vs OpenVEX vs SPDX
- 27:45VEX adoption and usage today
- 35:15VEX future: adoption, challenges, opportunities
- 43:18Q&A on VEX complexities
- 59:25Closing remarks
related talks
45mVEXing Open Source Security: Vulnerability Data for Everything
48m5 Steps to VEX Success: Managing the End-to-End Workflow
12mKeynote: We’re VEXing the Cloud Native Landscape. Bring Your Code!
50mBOF - Discussion Regarding False Positive Results from Vulnerability Scanners and the Use of VEX
47mVEX Overview
24mEmbracing the Era of Transparency: Automating VEX Application for Scalable, Context-Aware Security
26mStreamlining Vulnerability Management: The Power of VEX Inheritance in Container Ecosystems
28mWith VEX, The Possibilities are (Almost) Limitless!