This is how Vanta et al. make millions.
I don't think Vanta itself even scans for CVEs? They scan for compliance which includes tooling that may look for CVEs, like Dependabot.
Scanning companies should be sophisticated enough to distinguish invalid CVEs and back ported fixes.
alt Hacker News
I don't think Vanta itself even scans for CVEs? They scan for compliance which includes tooling that may look for CVEs, like Dependabot.
Scanning companies should be sophisticated enough to distinguish invalid CVEs and back ported fixes.