Dependabot and Trivy triage automation is the attach to vulnerability management as a control, not "we will close every CVE." Free autofix tools already exist. What SOC 2 CC7.1 and ISO 27001 A.8.8 actually test is a loop: find → prioritize → ticket → SLA → exception → retest — with evidence.
We automate triage so the SLA is achievable. We do not take an open-ended MSSP-style CVE SLA. Fixed-scope burn-down is a different engagement (vulnerability backlog burn-down).
Why Raw Scanner Output Fails Audits
Auditors sampling CC7.1 do not want a Trivy HTML dump. They want:
- Which findings were in-scope for production images
- Reachability / KEV / EPSS rationale (KEV/EPSS prioritization)
- Ticket IDs and close times
- Exceptions with expiry
A 4,000-finding Dependabot tab with no owners is not a control. It is a screenshot of overwhelm. CISA publishes KEV; use it as a ranking input, not as the only input.
Pipeline We Build
Trivy (CI + registry) + Dependabot alerts
→ normalize (package, CVE, repo, image digest)
→ suppress with reason + expiry (not silent close)
→ route Critical/High reachable to the owning CODEOWNERS team
→ nightly evidence export to S3 + GRC attachment
def route(finding: dict) -> str:
if finding["in_kev"] or finding["epss"] >= 0.5:
return "p1-ticket"
if finding["severity"] in {"CRITICAL", "HIGH"} and finding["reachable"]:
return "p2-ticket"
if finding["dev_only"]:
return "suppress-until-prod"
return "weekly-digest"
reachable is best-effort (call graphs, image used in prod). When unknown, we do not pretend it is safe — we label reachability=unknown and still SLA High in production images.
Suppressions are append-only: who, why, expiry. Silent ignore is how CC7.1 fails.
What We Will Not Sell
"We'll fix all Snyk/Trivy alerts as a service" loses to built-in autofix. The sellable layer is the control loop + evidence pack. Copilot Autofix can patch; it does not produce your exception register.
This plugs into the GRC platform you already run — same posture as other non-standard evidence.
Ask us what your GRC platform isn't covering → rutagon.com/contact · 907-841-8407 · contact@rutagon.com.
Ownership Beats Scanner Brand
The routing table fails when every CVE lands on a shared security queue. CODEOWNERS on the repo that produced the image is the default owner. Platform teams own base AMIs. App teams own application layers. If a finding is in a base image, ticketing the app repo trains people to close as "not us" and the SLA dies.
We encode that in the ticket body: image digest, Dockerfile line or lockfile path, KEV/EPSS, and the suppress-or-fix decision. Autofix PRs are welcome when CI is green; they are not a close without a human on Criticals in production tags.
Evidence Cadence
Nightly exports are a parquet or CSV in the log-archive bucket plus a GRC attachment. The export includes open, suppressed (with expiry), and closed-with-retest. A finding closed because "Dependabot PR merged" still needs the digest that ships to prod, not only the git SHA on main. Image promotion lag is a classic CC7.1 gap.
We keep exception expiry short — 30 to 90 days — so suppressions cannot become a second backlog. Expired suppressions reopen as tickets. That is the control. Silence is not.
Trivy misconfig (CIS-style) is a different queue from CVE packages. Mixing them in one SLA makes everything P2. Split: vuln packages vs hardened baseline drift. Both can feed the same GRC control with different evidence types.
Dependabot and Trivy triage automation that maps to CC7.1
Dependabot and Trivy triage automation fails when the ticket is “CVE-2024-xxxxx in libc” with no image digest and no owner. We attach the digest that is running (ECR, ECS task definition, or Kubernetes image pin), not only the Dockerfile on main. Promotion lag is the usual lie: GitHub says fixed, production still runs the old digest for eleven days. The evidence export must show digest-in-prod.
CISA’s Known Exploited Vulnerabilities catalog is a ranking input. KEV plus EPSS plus “is this reachable in the deployed image” beats CVSS-only panic. We still do not auto-close Criticals because a bot opened a PR. A human records fix, suppress-with-expiry, or accept-with-compensating-control. Suppressions without an expiry date become a second backlog.
Base-image findings route to the platform repo that owns the AMI or distroless parent. Application lockfile findings route via CODEOWNERS. If both fire on the same CVE, we duplicate-detect on CVE+package+digest so two teams do not “fix” the same layer twice and then fight over who closed the GRC issue.
Nightly parquet in the log-archive account is the system of record. The GRC attachment is a filtered view for the control owner. When the observation window is sampled, we can regenerate the same CSV from Athena. Console-only Dependabot tabs are not a control — GitHub retention and seat changes will bite you six months later.
False-positive debt we refuse to hide in Dependabot
License findings, noisy npm advisory republishes, and distro backport CVEs that Trivy still flags after the vendor patched in-place are the three piles that blow SLAs. We keep a written suppress taxonomy: not-reachable, mitigated-by-WAF-or-network, vendor-backport, waiting-on-upstream. Each row has an owner and an expiry. Infinite suppressions are how CC7.1 samples look like a junk drawer.
If two scanners disagree on severity, the ticket carries both scores and the decision. We do not average CVSS into a fictional “3.7.” Reachability in the deployed digest wins arguments. That is the production rule.
Frequently Asked Questions
Do we need both Dependabot and Trivy?
Dependabot is strong on GitHub-native dependency alerts. Trivy covers container images and misconfig. Together they reduce blind spots. One scanner with a real loop beats two scanners with none.
Can we auto-merge Dependabot PRs?
For low-risk patch trains, sometimes. Production services need CI gates and CODEOWNERS. Auto-merge is not a substitute for triage of Criticals that don't have a clean PR.
How does this map to CC7.1?
CC7.1 is about detecting and addressing vulnerabilities. Evidence is the ticket timeline and retest, not scanner market share.
What about infrastructure CVEs in AMI packages?
Trivy on the image digest, plus a rebuild pipeline. Ticket the AMI bakers, not a random app team. Ownership is the usual failure.
Will you run our SOC?
No. We engineer the loop. 24/7 vuln ops is out of scope on purpose.