Dependency vulnerabilities: what to get right first

We end up explaining this on discovery calls often enough that it deserved writing down. If you only fix one thing about dependency vulnerabilities this quarter, make it the first item below.

The cheapest security work is the boring kind done on a schedule. It rarely shows up as a line item, which is exactly why it slips.

Start here

Your code is a small part of what you ship. The cost of getting this wrong is rarely visible on the day it happens. Anything you cannot measure here, you are deciding by taste, which is fine as long as everyone knows it.

Then this

Automated alerts catch what manual review never will. Where this goes wrong is almost never a lack of knowledge. Doing this properly once is usually cheaper than doing it approximately three times.

Eventually

Fewer dependencies is a security strategy. This is the sort of thing that compounds, quietly, in both directions. Budget a little time for it every quarter and it never becomes a project of its own.

The short version

The realistic threat for most small businesses is automated and opportunistic, not targeted. Three things worth confirming about dependency vulnerabilities before you move on:

• Someone can say what the current setup is without going to look
• Fewer dependencies is a security strategy — and you know whether that is true here
• There is a way to tell whether the last change to this helped

Worth checking on your own setup before it becomes someone else's problem to fix.