Guidance and best practices

How to prioritise fixes, scan well, plan quantum readiness and keep BOMs audit-ready.

Prioritising fixes

• Rank by exploitability first, then severity. A High CVE in CISA KEV or with EPSS ≥ 50% beats a Critical one with no known exploitation.
• Filter to Fix Available for quick wins; track No Fix Yet and No Planned Fix as accepted risk.
• Fix at the package level; the Top Vulnerable Packages lists show where one upgrade clears dozens of CVEs.
• Read a component's patch-status notes before upgrading; some upgrades leave findings open.

Scanning

• Run Check connection before every scan; most failed runs are on machines marked Non Reachable.
• Use Scan paths to keep scans fast on large hosts, but remember an empty list scans the whole machine.
• Enable AIBOM only after adding at least one AIBOM target; it runs as a separate scan.
• Re-scan on a regular cadence and review BOM Drift after each run.

Crypto and quantum

Plan certificate renewals with the NIST IR 8547 milestones in mind, watch the Certificate Expiry list for anything expiring within 90 days, and use Migration Coverage as the headline KPI for post-quantum readiness.

BOM quality and compliance

• Generate BOMs in CycloneDX for the richest analysis; SPDX is also supported.
• In BOM Inspector, auto-generated BOMs top out around 66.7% on some frameworks; fields such as author, signature and generation context need manual enrichment at the source.
• Score against the framework your regulator or customer uses, and export findings as evidence.

Licences and access hygiene

• Review every Strong Copyleft and Commercial item before distributing software.
• Resolve Unknown and Unmatched / Unclassified licences; they hide real obligations.
• Give each user the narrowest role that fits; prefer SSO over local passwords.
• Issue CI tokens with the shortest validity that works, label them, and revoke unused ones.
• Add your company logo so downloaded BOM reports carry your branding.