| name | audit-dependency-vulnerabilities |
| description | Use when auditing third-party dependencies for known vulnerabilities, license issues, or supply chain risks |
| source | OWASP A06:2021 – Vulnerable and Outdated Components; NIST NVD (nvd.nist.gov); Snyk (snyk.io); GitHub Advisory Database |
| tags | ["security","dependencies","vulnerabilities","owasp","supply-chain","cve","snyk"] |
| verified | true |
Audit Dependency Vulnerabilities
Systematically scan, triage, and remediate known vulnerabilities in third-party dependencies to reduce supply chain risk.
Why This Is Best Practice
Adopted by: GitHub (Dependabot), Snyk (used by Google, Salesforce, Adobe), OWASP top 10 mandates
Impact: OWASP A06:2021 moved Vulnerable Components from #9 to #6; the Log4Shell vulnerability (CVE-2021-44228) affected 93% of enterprise cloud environments and cost organizations an average of $4.6M to remediate (IBM 2022).
Why best: Third-party code is the majority of most applications. Vulnerabilities in transitive dependencies are as exploitable as direct ones — Log4Shell was a transitive dependency in most affected systems. Automated scanning must be continuous, not a one-time audit.
Steps
- Generate a Software Bill of Materials (SBOM) — Produce a dependency manifest: , , , or use for container images.
