VEXatious Vulnerabilities: CVE Management for the Overwhelmed Security Engineer

Learn how to effectively manage CVEs using VEX documents in this security conference talk from BSides London. Discover practical solutions for application security engineers facing overwhelming vulnerability management challenges, including dealing with increasing CVE volumes, scanner inaccuracies, and dependency requirements. Explore a proven workflow implemented at Cilium that leverages VEX documentation to automate CVE exclusions, distribute security triage responsibilities, and generate comprehensive vulnerability applicability documentation. Through real-world examples from Isovalent's security practices, gain insights into implementing VEX documents to streamline security workflows and focus efforts on addressing genuine vulnerabilities rather than getting bogged down in spreadsheet management.