Dependency vulnerabilities: the questions we get asked most

It comes up on almost every project, usually later than it should. The questions about dependency vulnerabilities that come up most often on our calls.

Security is a maintenance habit rather than a purchase, which is why it drifts. Anything you cannot measure here, you are deciding by taste, which is fine as long as everyone knows it.

Do we need to care about this?

Your code is a small part of what you ship. The teams that handle this well are rarely the ones with the biggest budgets. It is the sort of thing that looks like polish right up until it costs you an enquiry.

Can it wait until after launch?

Occasionally. More often the post-launch version costs several times the pre-launch one. None of that requires a large budget, only a decision and someone to own it.

How do we know it is working?

Fewer dependencies is a security strategy. It is worth being explicit about, because assumptions differ quietly. Write the reasoning down alongside the decision, because the reasoning is what changes first.

In practice

The realistic threat for most small businesses is automated and opportunistic, not targeted. Three things worth confirming about dependency vulnerabilities before you move on:

• Someone can say what the current setup is without going to look
• Fewer dependencies is a security strategy — and you know whether that is true here
• There is a way to tell whether the last change to this helped

If you want a second opinion on how yours is set up, ask.