“Our procurement questionnaire, required under DORA4 and EU CRA5, asks for a list of all open CVEs and a remediation timeline before we can proceed.”
“EU CRA Art.145 requires vendors to supply security updates for the product’s full support period. Please supply your CycloneDX SBOM and evidence of patching cadence before signing.”
“CVE-2024-3094 appeared in your SBOM at contract start. It is still unpatched. Our legal team needs a written remediation plan, required for our own DORA4 compliance filing.”
“DORA Art.194 requires initial notification within 4h of CRITICAL classification. CVE-2024-3094, -6387, and -4577 are all past that window. Please provide remediation status in writing.”
Does this resonate, or am I overstating it? I'm conducting a round of research and would love 30 minutes of your time to learn more. I'll share the (anonymised) research with all participants.
Thirty minutes. I want to understand how the three forces above are showing up in your actual day-to-day, or whether they aren't, which is just as useful to know.
Where does CVE-patching responsibility actually sit at your company: security team, platform/SRE, application teams, somewhere else, or nowhere in particular?
Manual scan-and-triage; automated pipeline; third-party service; something more bespoke; or honestly, not much yet?
Are customers, auditors, or regulators already asking for proof of patching cadence, or is that still hypothetical at your scale?
I'm aggregating answers across everyone I talk to. Once I have enough, I'll share back the anonymised synthesis: what techniques are actually working, where the regulatory pressure is real-now vs hypothetical, and what patterns emerge across very different organisations. You get the synthesis, not just the satisfaction of helping me.
This is customer discovery. I'm interviewing operators about how the three forces above are reshaping their work. Pick a slot below. You'll get the call notes back (anonymised) along with the aggregate synthesis once I've talked to enough people.
Twenty-five years in software engineering, DevOps, SRE, and release engineering at Pivotal, VMware, Shopify, Mechanical Orchard. I work specifically on the supply-chain side: reproducible builds, SBOM generation, dependency provenance, CVE remediation pipelines. Lately, I've been discovering I love supervising LLM agents through this kind of work: the patient, tedious compliance grind that makes other engineers run away screaming. Based in Dublin.