Engagement 04
Exposure Answer
When the next advisory lands, answer “are we affected” in hours rather than weeks.
The situation
The question that follows a major advisory is always the same, and it is never whether the vulnerability is serious. It is “are we affected”, asked by someone who needs the answer before the end of the day.
Companies that answer in hours assembled the inventory before the event. Companies that answer in weeks are assembling one during it — which is also the week every engineer who could help is already occupied.
This is you if
- The last major advisory cost you a week of engineering time just to establish scope.
- You cannot produce a current list of what you ship and what is inside it.
- Your customers ask for an impact statement faster than you can assemble one.
How it runs
- Setup
Build the inventory once
An SBOM for everything you ship, resolved through the transitive components, with ownership attached. Everything else depends on this artifact existing before it is needed.
- Quarterly
Refresh and re-resolve
The inventory is rebuilt against what you ship now, so it is accurate on the day you need it rather than on the day it was first made.
- On an event
Triage and take a position
When a named advisory lands we resolve your exposure against the inventory and produce a documented VEX position — including “present but not exploitable here”, which is the common answer and the hardest to defend without evidence.
What you are left holding
- An SBOM and component inventory of everything you ship, kept current quarterly
- VEX-based triage when a major event hits, so “not exploitable here” is a documented position
- A named response path with an agreed clock, rehearsed before you need it
- The inventory that the CRA reporting obligation assumes you already have
What we need from you
- A build that can be instrumented to emit an SBOM, or access to the artifacts to generate one from.
- A named owner on your side for the response path, and a clock you are willing to commit to.
- Notice of what counts as shipped: releases, images, firmware, hosted services.
A fixed fee that assumes nothing about access is a guess. This is the list that keeps the price the price.
What this is not
- Not a monitoring product. Nothing is installed in your runtime and no agent is deployed.
- Not incident response. We establish exposure; containment and remediation stay with your team.
- Not a discharge of the CRA reporting obligation, though the inventory is what that obligation assumes you already have.
Why people call about this one
The window has closed
Attacker tooling now moves at machine speed through exactly the paths developers trust. Leadership asks one question when an advisory lands, and it is not a tooling question.
The axios, GhostAction and LiteLLM compromises all share one shape: "are we affected?" with no fast way to answer
The shape of it
- Shape
- Retainer, with a quarterly refresh
- Usually funded by
- CISO · Engineering
- Often leads to
- Nothing. This one stands alone.