FOSSA: Allan Friedman

What it is

A practitioner guide from Allan Friedman (formerly NTIA/CISA) on running VEX workflows in production, based on his 2026 FOSSA webinar "A Practical Guide to VEX in 2026." The summary lists the workflow steps; what follows is the decision criteria and distinctions inside those steps that actually govern the work.

What to do

When to issue a VEX (publishing policy). Don't emit one per CVE. Following CISA guidance, publish a statement when the vulnerability is in your SBOM, when your audience (customers, leadership) will care, or when it could damage trust in your sector. Publish predictably — via API, a standard project repo directory, or an RSS feed.

When to update (close the loop). Trigger a statement update when an under-investigation vuln gets resolved, when something is added to the KEV list, or when a new version patches the issue. Stale VEX data is treated as worse than none.

What to capture in each determination. Record who made the decision, when, and why. The analysis is the hard part; documenting it is easy but non-negotiable.

Pick your audience deliberately. Internal DevSecOps and external Product Security are different targets with different outputs:

flowchart TD
    A[VEX determination] --> B{Audience?}
    B -->|Internal DevSecOps| C[Shared team ground truth;<br/>overproduction OK if process is solid]
    B -->|External Product Security| D[Cross org boundary:<br/>sanitize + make understandable<br/>without local context]

Consumer side. Land all VEX (CSAF, OpenVEX, CycloneDX, SPDX) in one place — ideally the same system holding your SBOMs; large enterprise suppliers may need custom ingestion harnesses. Correlate VEX against scanner output and other threat intel rather than trusting it alone. Establish trust levels in advance: is the statement from a random party or the actual maintainer?

Caveats

• Friedman explicitly warns against AI-accelerated reachability analysis: it's easy to assert something isn't reachable "and then have the next version of Claude find a way to reach it." Treat tool output as a starting point, not proof.
• VEX is only as good as its source — the piece frames it plainly ("someone on the internet told me I don't have to care"); trust, provenance, and traceability remain the reader's work, not something the format supplies.
• The fetched consumer section is truncated mid-sentence at step 3 (establishing trust); the source webinar recording covers the full treatment.