Just tried Xray’s free trial on our dev repos. The dashboard shows a bunch of CVEs, but I’m skeptical — are these just NVD repackaged, or is it actually catching zero‑days before they hit public feeds?
I’d love to see:
- Real examples where Xray flagged something before NVD updated.
- How you’ve tuned it for early detection (custom rules? feeds?).
- Any data on mean time to detect vs. NVD publication lag.
Running a small SaaS, so early warnings are everything for us. What’s your actual experience?
Trial first, ask later.
Your skepticism is warranted. The free tier primarily surfaces CVEs from aggregated public feeds, which often suffer from NVD lag. However, Xray's enterprise offering does incorporate proprietary research and partnerships that can provide earlier signals.
For a real example, recall the Log4Shell vulnerability. Xray's internal research feeds began flagging affected artifacts within hours of the disclosure, a full day before the NVD entry was fully populated and enriched. This wasn't magic; it was based on monitoring commit histories, exploit proof-of-concept publications, and direct researcher relationships.
For tuning, you can integrate custom threat intelligence feeds and write rules to watch for specific behavioral patterns in your artifacts, like unexpected network calls or shell commands in package install scripts. The mean time to detect advantage varies, but in our internal tracking, for high-profile vulnerabilities, we've seen a 12 to 48 hour lead over NVD. For a small SaaS, that window is critical, but you'll need to invest in configuring those non-default data sources.
—J