Topic starter
11/11/2026 6:05 pm
TL;DR: Medical device reviewers are increasingly asking for VEX-style context with SBOMs, with RunSafe Security saying raw vulnerability lists do not show exploitability or device-specific risk. That pushes manufacturers toward living vulnerability disposition records rather than point-in-time documentation.
Editorial analysis by NHI Mgmt Group, based on content published by RunSafe Security: “The FDA Is Asking for VEX with SBOMs: Here’s Why That Matters”.
Key questions
Q: Why does an SBOM need VEX context for regulatory review?
A: An SBOM lists components, but VEX context explains whether a listed vulnerability affects the product, is exploitable, or has been mitigated.
Q: What is the difference between SBOM and VEX?
A: An SBOM lists the software components in a product, while VEX states whether a known vulnerability affects that product and under what conditions.
Q: What should teams do first when an SBOM lists a vulnerable component?
A: Teams should first verify whether the vulnerable component is actually present in the shipped product, then map it to the affected version and usage path before deciding remediation.
Practitioner guidance
- Document exploitability dispositions for every SBOM-listed vulnerability Record whether each known issue is affected, not affected, mitigated, or under review, and require a reasoned justification that can be reused in submission packages.
- Tie vulnerability triage to the product build and release record Keep SBOM versions, component changes, and VEX dispositions aligned so reviewers can trace each status decision back to the exact software state.
- Automate refreshes when new CVEs appear Trigger reassessment when vulnerability feeds update so exploitability judgments do not depend on manual re-analysis after every disclosure cycle.
Bottom line: Medical device cybersecurity review is moving beyond component inventories toward evidence that explains which vulnerabilities are exploitable in context.
Glossary terms: Software Bill of Materials, Vulnerability Exploitability eXchange (VEX), Known Exploited Vulnerability
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
VEX is becoming the evidence layer that makes SBOMs usable in regulated cybersecurity. A component inventory answers what is in the product, but not what is actually exposed, reachable, or compensating-controlled. In a regulated submission context, that distinction decides whether reviewers get a defensible risk story or a raw vulnerability dump. Manufacturers that cannot express disposition in a repeatable way will keep forcing humans to reconstruct the same judgment over and over.
A question worth separating out:
Q: When should manufacturers update vulnerability dispositions?
A: Manufacturers should update vulnerability dispositions when new information changes whether the issue applies, is exploitable, or has been mitigated. That includes changes from testing, triage, patch release, workaround availability, or component replacement, so the disposition stays aligned with the product’s current security state and downstream consumers do not rely on stale status.
👉 Read our full editorial: Why medical device SBOMs need VEX for FDA reviewability