SOSS Community Day Europe 2024

VEX, the Vulnerability Exploitability Exchange, is a communications channel that informs consumers about the impact of a vulnerability on a piece of software. Since its inception about two years ago, the SBOM/VEX community has been busy implementing the required pieces to enable VEX data to flow seamlessly from projects to security scanners. With the recent adoption of OpenVEX in the Go security tooling, we can finally generate automated VEX streams that don't involve human intervention and can be fully trusted as its statements are generated from reachability data from the compiler. It is a major milestone that marks a new phase in the OpenVEX ecosystem's maturity. Join us as we build a trusted end-to-end VEX stream, from code to scanner diving deep into a VEX document and we explore other highlights of the OpenVEX ecosystem.