What to ask your agency about dependency vulnerabilities

Teams tend to reach for this after something has already gone wrong. If you are briefing an agency or a freelancer on dependency vulnerabilities, these questions are worth asking early.

The cheapest security work is the boring kind done on a schedule. The version that survives contact with a real deadline is the simple one.

Questions worth asking

• Who will actually do this work, and have they done it before?
• How will we know afterwards whether it worked?
• What happens if it needs changing in a year?
• What are you assuming that we have not confirmed?

What a good answer sounds like

Your code is a small part of what you ship. In practice this is a scheduling problem more than a technical one. Budget a little time for it every quarter and it never becomes a project of its own.

Fewer dependencies is a security strategy. The reasoning matters more than the rule, because the rule has exceptions. The failure mode is not doing it wrong, it is doing it once and assuming it stays done.

How to tell if yours is fine

The realistic threat for most small businesses is automated and opportunistic, not targeted. Three things worth confirming about dependency vulnerabilities before you move on:

• Someone can say what the current setup is without going to look
• Automated alerts catch what manual review never will — and you know whether that is true here
• There is a way to tell whether the last change to this helped

Pick the one that would hurt most if it failed, and start there.