CVE Statements

CVE Statements allow you and your vendors to provide your own view of a CVE, whether you're affected, still reviewing, or have chosen to accept the risk. These statements don’t override Bitsight’s independent evidence, but they give valuable context to your internal teams and any third parties monitoring you.

Whether you're managing your own security posture or evaluating your vendors, CVE Statements help you track what matters, reduce noise, and improve communication.

CVE Statements are self-attested by each company, managed independently from Bitsight's evidence, do not influence ratings, and remain unchanged unless manually updated.

Why Use CVE Statements?

For managing your own vulnerabilities (SPM):

• Add internal context to detected CVEs.
• Reduce noise and focus on CVEs that require attention.
• Share your position with third-party monitors (if desired).
• Click here to learn more about managing CVEs in your own organization.

For monitoring vendors (CM):

• Understand how vendors interpret or respond to CVEs affecting them.
• Quickly identify if a vendor has not addressed or reviewed a CVE.
• Focus due diligence and follow-up efforts more effectively through Vendor Access.
• Click here to learn more about reviewing Vendor CVEs for third party risk management.