Vulnerability Management

Security Requirement

AI software projects MUST have a plan to quickly patch and release fixes for new CVEs discovered in their dependencies. Unpatched vulnerabilities in dependencies are one of the most common attack vectors.

Vulnerability Management Process

New CVE disclosed
  → Automated alert (from SCA tool or advisory feed)
  → Triage: assess severity and exploitability in context
  → Prioritize: schedule fix based on severity and exposure
  → Patch: update dependency or apply workaround
  → Test: verify the fix does not break functionality
  → Release: publish patched version
  → Notify: inform users of the security update