You can prioritize Dependabot alerts in your organization by analyzing the provided metrics. Using this approach, you can tell your developers to focus on the most important vulnerabilities first.
Application Security (AppSec) managers often face a flood of Dependabot alerts, making it challenging to determine which vulnerabilities to address first. Dependabot metrics provide valuable insights that help prioritize alerts efficiently, ensuring that critical security issues are resolved promptly. Users can make informed decisions, focusing resources on the most impactful vulnerabilities. This approach strengthens the organization’s security posture and streamlines vulnerability management.
Dependabot metrics offer detailed information about vulnerabilities detected in your dependencies. Key metrics include:
For more information about these metrics, see Metrics for Dependabot alerts.
Additionally, you can specify complex filters, which are combinations of the individual filters that are available. For more information about filters, see Dependabot dashboard view filters.
These first steps help you identify the Dependabot alerts that put your organization the most at risk, so that you can tell your developers which alerts to focus on for remediation.
You can customize the default funnel order on the "Alert prioritization" graph to ensure it reflects the unique risk profile, business priorities, and compliance requirements of your organization. See Viewing metrics for Dependabot alerts.
Start by identifying alerts with the highest severity by using the severity-critical or severity-high filters. These vulnerabilities pose the greatest risk and are often prioritized by compliance standards.
Prioritize vulnerabilities that are the most likely to be exploited in your codebase. To identify alerts that are most likely to be exploited, you can use the epss-percentage filter associated to a value (for example epss-percentage:>=0.10).
Direct dependencies are typically easier to update and may have a greater impact on your application’s security. We recommend addressing these before transitive dependencies when possible.
Filtering alerts using the relationship:direct filter allows us to see vulnerabilities on direct dependencies for supported ecosystems like npm.
Runtime dependencies are used by an application in production. Updating this sort of dependency can address security vulnerabilities, bug fixes, and performance improvements that affect your end users or systems directly. On the other hand, development dependencies are only used during development, testing, or build processes. While important, issues in these dependencies usually don’t impact your running application or its users.
You can use the scope:runtime or scope:development filters to only display alerts for runtime or development dependencies, respectively.
Older alerts may indicate long-standing risks. Regularly review and address aged alerts to prevent security debt from accumulating. For example, once you establish that a specific repository has more alerts that need prioritizing than other repositories, you can:
Use Dependabot’s automated pull requests to quickly remediate vulnerabilities. Integrate these updates into your CI/CD pipeline for faster resolution and improved efficiency.