Her team's investigation revealed that roughly six out of ten vulnerabilities associated with certified products, excluding smartcards, became public subsequent to the certification date. Furthermore, Bakhtina introduces sec-certs and SCRUTINY, two open-source utilities developed by her laboratory, alongside advising purchasers on a singular query to pose to a vendor.
This analysis suggests that security certifications represent a static point in time, a perspective that procurement managers often overinterpret.
These findings underscore the operational reality that security assurances, even those formalized through rigorous standards, do not guarantee perpetual protection against emergent threats within the software ecosystem.
Why it matters
Operators must understand that security certifications are only a snapshot in time, not a guarantee of ongoing security. Procurement teams should use tools like sec-certs to gain a more complete view of a vendor's security posture.
