Blog
Advisories arrive every day, and high scores are not unusual. Yet you cannot tell from reading one whether it has anything to do with you.
Vulnerability advisories arrive every day, and high scores are not unusual. Yet you cannot tell from reading one whether it has anything to do with you.
Whether an advisory applies to you is decided by what you are actually running. Without that, the question has no answer.
And recalling it every time is hard work. What runs on the server, which components sit on top, what somebody installed years ago and left behind. Almost nobody can recall every version they have running. You can go and look, but not once per advisory.
So people stop reading. Filtering by severity does not rescue you either, because severity measures the risk to the world, not to you. A 9.2 is irrelevant if you do not run the thing. A 5-point issue in something you depend on needs your hands today.
We changed the order of operations. Instead of investigating per advisory, we list what we run once and hand that over.
Every morning the day's disclosures are collected and cross-checked against that list, and the result comes back as a table. Ours runs at 04:00, so the comparison is already on the desk when the day starts.
We added one requirement when setting it up: for anything judged not to apply, give the reason in one line. That turned out to matter more than expected.
A report that says only "three items apply" leaves the rest unexplained. You cannot tell whether they were missed or considered and excluded. One line of reasoning — "this concerns a different product", "we do not use that feature" — makes the remainder safe to skip. Being able to skip with confidence is the real gain.
The morning after we set this up, the report flagged that an advisory from the previous day had been re-evaluated. What had read as general advice the day before now came with the judgement that, in the combination we run, it deserved to be treated as considerably more serious.
Tracking it by hand, I would almost certainly have missed that. I would have read it once on the day of publication and filed it as handled. Advisories are not final when published; assessments change afterwards. Repeating the same comparison every morning is also how you catch that.
I do not believe this is sustainable by hand. Collect the day's disclosures, then check them one by one against what you run. A single day might take thirty minutes. You would be repeating that every day, including the many days when nothing relevant appears. Days get skipped — and the skipped day is the one that mattered. Worse, you never know whether you missed something.
We hand this to the AI working inside miraiGen.™Cube. What changed after handing it over was less about saved effort and more about this: the anxiety around running our own servers dropped. Every disclosure used to leave a residue of doubt — was there something I failed to notice? Now a cross-checked table with reasons attached is waiting every morning. When something is marked as not applicable, I can proceed on that basis. That calm is something I never had when I watched the servers myself.
What makes advisories exhausting is not the volume. It is starting the reasoning from zero every time. Writing the inventory down once removes that part.