Vulnerability Exploitability eXchange (VEX) in Practice: Communicating Exploitability

IntermediateFree5 modules · 14 lessons · ~2 min

About this course

Learn to tell the world, precisely and verifiably, which vulnerabilities in your SBOM actually matter. This course covers CISA's minimum requirements for VEX, the CSAF, OpenVEX and CycloneDX formats with complete worked documents and crosswalks, how to author defensible not_affected justifications from reachability evidence, and how to consume, verify and share VEX using Safeguard's Upload CSAF/VEX integration, Vulnerabilities and Mitigations tabs, VEX Readiness policy, Portal Sharing and TPRM.

What you'll learn

Why VEX Exists

The SBOM Noise Problem
VEX as a Negative Security Advisory: Roles and Neighbors
CISA Minimum Requirements and the Four Statuses

The Three Formats: CSAF, OpenVEX and CycloneDX

The CSAF 2.0 VEX Profile
OpenVEX
CycloneDX VEX: Embedded and Standalone
Crosswalk: Statuses, Justifications, Product Identification and Lossy Conversion

Authoring VEX Statements

The Five Justifications, with Code-Level Examples
Evidence: Reachability, Runtime Context and the Decision Record
Action Statements, Fixed Status and Revision History

Consuming and Sharing VEX

Ingesting VEX into Safeguard and Reconciling with Findings

01Why VEX Exists3 lessons

The SBOM Noise Problem
VEX as a Negative Security Advisory: Roles and Neighbors
CISA Minimum Requirements and the Four Statuses

02The Three Formats: CSAF, OpenVEX and CycloneDX4 lessons

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

Trust, Signing, Staleness and Supplier VEX in TPRM

Sharing VEX Outward and the Regulatory Pull

End to End: From Disclosure to Verified VEX

A Scenario: CVE Disclosure to Published VEX and Consumer Verification

The CSAF 2.0 VEX Profile

CycloneDX VEX: Embedded and Standalone

Crosswalk: Statuses, Justifications, Product Identification and Lossy Conversion

03Authoring VEX Statements3 lessons

The Five Justifications, with Code-Level Examples
Evidence: Reachability, Runtime Context and the Decision Record
Action Statements, Fixed Status and Revision History

04Consuming and Sharing VEX3 lessons

Ingesting VEX into Safeguard and Reconciling with Findings
Trust, Signing, Staleness and Supplier VEX in TPRM
Sharing VEX Outward and the Regulatory Pull

05End to End: From Disclosure to Verified VEX1 lessons

A Scenario: CVE Disclosure to Published VEX and Consumer Verification2 min

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.