What is VEX?
VEX stands for Vulnerability Exploitability eXchange.
VEX, or Vulnerability Exploitability eXchange, is a machine-readable statement about whether a specific vulnerability actually affects a specific product — allowing a vendor to say that a CVE present in a dependency is not exploitable in their build, and why.
In depth
Understanding VEX
SBOMs created a problem alongside the visibility they provide. Once customers can see every component, they can also see every CVE ever filed against those components, and most of those CVEs do not affect the product — the vulnerable function is never called, the feature is compiled out, or a mitigation is already in place.
Without a way to say so, vendors field the same question repeatedly and customers cannot distinguish a real exposure from noise. VEX is the format for that answer: a status per vulnerability per product, with machine-readable justification.
OpenVEX is one implementation, deliberately minimal, designed to be produced automatically rather than authored by hand. The statuses are the useful part: not affected, affected, fixed, or under investigation.
In RedStrike
How RedStrike handles VEX
RedStrike produces OpenVEX 0.2.0 documents as an export format. The verification engine is a natural source for them: when a finding has been tested and shown not to be exploitable in your build, that determination is exactly the statement VEX is designed to carry.
FAQ
Frequently asked questions
Common questions about VEX.
Is VEX a replacement for an SBOM?
No, they answer different questions and are used together. The SBOM says what is in the product. VEX says which of the known vulnerabilities in those components actually affect it.
Who produces a VEX document?
Normally the software producer, because determining that a vulnerable code path is unreachable requires knowledge of the build. A downstream consumer can produce one for their own deployment, but it does not carry the same authority.
See VEX in practice
Run continuous, verified security testing across your applications, APIs, and cloud accounts.