Article 14 is live, which means somebody eventually has to explain why a given vulnerability was or wasn’t reported. That explanation is the deliverable, not the number. Working from one real container SBOM and multiple scanners and databases that disagree with each other, this talk builds the audit trail backwards: what you matched, what you dropped, what you assumed, and what evidence you kept. Less about tooling selection, more about the artefacts that make a defensible process. Closing posture, unchanged since April: sources will contradict, you will have to be opinionated, and your CRA defence is in the process. This is not a finish line, it’s a treadmill.
Conference partners
Organiser
