VEX — Vulnerability Exploitability eXchange

VEX (Vulnerability Exploitability eXchange) is a machine-readable standard developed by CISA that answers one specific question: does this known vulnerability actually affect my software?

A CVE might exist in a library your project uses, but your application might never call the vulnerable code path, or the component might not even be shipped in your final artifact. VEX captures this context so your team spends time on vulnerabilities that are genuinely exploitable — not on noise.

---

Why It Matters

Without VEX, every detected CVE looks equally urgent. Security teams end up triaging dozens of findings that tools like JFrog Xray or Black Duck already know are not exploitable in that specific context. VEX brings that scanner knowledge directly into Invicti ASPM, and also lets your team add their own exploitability judgments at scale.

In practice, VEX helps you:

• Automatically mark non-applicable vulnerabilities as False Positives without manual review
• Confirm exploitable vulnerabilities as True Positives so they get prioritized correctly
• Carry exploitability context from your SCA scanners into the ASPM workflow without duplicate effort
• Import your own VEX files (OpenVEX format) to apply organization-wide or project-wide exploitability decisions

---

VEX States

Every VEX statement assigns one of four states to a vulnerability for a specific component:

Justifications for "Not Affected"

When a vulnerability is marked Not Affected, a justification explains why:

---

How VEX Works in Invicti ASPM

VEX data enters the platform from three sources, each with a defined trust level. When multiple sources provide a statement for the same vulnerability, the higher-trust source always wins.

Supported Scanners

The following SCA scanners report native exploitability data that Invicti ASPM automatically ingests as VEX statements:

Scanner VEX is ingested on every scan and kept current. If a scanner retracts or changes a statement in a later scan, the stored state is updated automatically.

---

Automatic Triage (VEX-to-Action Mapping)

Invicti ASPM can automatically apply triage actions based on VEX state. This removes the need to manually review every vulnerability that a scanner already classified.

This mapping is configurable per project. If you prefer to review VEX-driven findings before they are triaged, you can disable automatic mapping — VEX state will still be displayed on vulnerabilities, but no triage flag will be set automatically.

Important: If a team member has already triaged a vulnerability manually, automatic VEX-to-action mapping will never override that decision. Manual triage always takes precedence.

---

Importing VEX Files

You can upload an OpenVEX-format .json file to apply exploitability statements across a project in bulk. This is useful when:

• Your security team maintains a shared VEX document for a product line
• You want to carry over VEX decisions from a previous tool or workflow
• You have a compliance-driven requirement to document exploitability

Limits per project:

• Maximum 20 VEX imports at one time
• Maximum file size: 10 MB
• Each import can be deleted; deleting an import reverses any triage actions it created

After an import is uploaded, the platform applies statements asynchronously across all matching vulnerabilities in the project. You can track apply progress in the VEX Events view.

---

Manual VEX Statements

Team members with the appropriate permissions can create VEX statements directly on a vulnerability without uploading a file. This is the highest-trust source — manual statements override both imports and scanner data.

Use manual statements when:

• A scanner incorrectly classifies a vulnerability
• You want to document an exploitability decision for a specific finding
• No scanner VEX data is available for a component

---

Where to Find VEX in the UI

---

Filtering Vulnerabilities by VEX

The vulnerability list supports filtering by:

• VEX State — affected, not_affected, fixed, under_investigation
• VEX Justification — any of the five standard justifications
• VEX Source — scanner, import, manual

These filters can be combined with any other vulnerability filter (severity, CVSS score, tool, etc.).

---

Exporting VEX Data

OpenVEX Export

You can export all active VEX statements for a project as a standards-compliant OpenVEX JSON file. The export includes statements from every source — scanner, import, and manual — and can be used to:

• Share your exploitability decisions with other teams or tools that support the OpenVEX standard
• Archive a point-in-time snapshot of your project's exploitability posture
• Re-import into another project or environment

The export is available from the VEX Imports section in project settings, or via the API. The resulting file is signed with the exporting user's identity as the document author.

CSV Export

VEX state and justification are included in vulnerability CSV exports as the vexState and vexJustification columns, so you can include exploitability context in compliance reports or offline analysis.

---

Frequently Asked Questions

What happens if the scanner changes its VEX assessment on a later scan?
The scanner statement is updated automatically. If the new assessment would change the triage state, the platform re-evaluates and updates accordingly — unless a higher-priority source (import or manual) is already in place.

Can I disable scanner VEX ingestion?
Yes. Scanner VEX ingestion can be disabled at the project level. Imports and manual statements continue to work regardless of this setting.

Does VEX work for all scanner types?
VEX is currently supported for SCA (Software Composition Analysis) scanners only, since SCA is where component-level exploitability data is most meaningful.

What is OpenVEX?
OpenVEX is an open specification published by CISA for representing VEX statements in JSON format. Invicti ASPM supports importing and exporting in OpenVEX format, making it compatible with other tools in the ecosystem.