SBOM and VEX: Turning Vulnerability Data into OT Risk Decisions

Cybersecurity Under Pressure. Real Attacks, Real Lessons · Oct 7, 2026 · 1h 31m

A software inventory cannot tell you which vulnerability threatens production. Explore how SBOM, VEX, exploitability and deployment context support defensible treatment decisions in cyber-physical systems. Learn what evidence suppliers and operators need before accepting, mitigating or patching a vulnerability.

Chapters:

00:00 Context and central question

18:10 The Technical Breakdown

34:30 The Operational Decisions

51:46 The Pressure Test

01:09:46 The Key Takeaways

More analysis: https://cybersecurityunderpressure.com/

Related CUP episodes:

When VEX Becomes a Bureaucratic Shield

NIST IR…