What Is VEX? How It Tells Which Vulnerabilities Matter

About this video

A vulnerability scanner can flag hundreds of CVEs in a single container image, and some of them can’t be exploited where you run it. VEX (Vulnerability Exploitability eXchange) is how a software supplier tells you which ones apply.

In two minutes, this video covers:

What VEX is and how it pairs with an SBOM

The four statuses: not affected, affected, fixed, and under investigation

Why a “not affected” status must carry a reason, and what that does for your audit trail

Where minimal images fit, by reducing how many vulnerabilities you have to triage in the first place

Explore minimal, source-built container images: https://images.cleanstart.com

• VEX
• SBOM
• CVEs