VEX and the Shift From Vulnerability Presence to Exploitability

Container images routinely surface hundreds of CVEs, and less than 10 percent are typically exploitable in a given runtime context, yet scanners and SBOMs report them all with equal weight. This architecture insight argues that exploitability context belongs with the artifact, and explains how VEX (Vulnerability Exploitability eXchange) marks each vulnerability as not affected, affected, fixed or under investigation, with a justification. It shows how CleanStart publishes and maintains VEX as part of the image build, in open standard formats that Trivy, Grype and Docker Scout read directly.