A vendor ships an appliance as an RPM under its own product name with no component list — what do you do?

## Why this one is different Every other identity break in this area is something your own build did to itself and can therefore undo. This one is not. A vendor takes an upstream project, patches it, configures it, packages it under their product name, and ships you a binary. The mapping from their product to the components inside it exists only on their side. You can hash the package, you can note the vendor, the product and the version — and that is the end of what you can assert. Guessing at the upstream project from documentation or from strings in the binary produces confident wrong answers in both directions: claims about components that were replaced, and silence about components you never suspected. That makes this a governance problem wearing a technical costume, which is why the good answer is not a better scanner. ## Lever one: procurement The only durable fix is that the vendor tells you. Ask for it in terms that are specific enough to be testable: - **A component-level SBOM per shipped release**, machine-readable, with supplier name, component name, version and other unique identifiers per component plus the dependency relationships between them — the shape the NTIA minimum elements describe, together with the author and timestamp that make the document itself accountable. - **A product-keyed vulnerability channel.** You need statements about *their* build. A vendor who says "our product is not affected by that defect because the vulnerable code path is not built in" has answered a question you could never answer from outside, and a VEX statement of `not_affected` carries a justification precisely so the claim can be judged rather than trusted. - **A response commitment**: how quickly they will state a status after a defect is published, and how fixes are delivered. The leverage is renewal and initial purchase, not an incident. Regulation is moving in the same direction — the EU Cyber Resilience Act places obligations on manufacturers of products with digital elements, and US federal procurement has pushed SBOM expectations through EO 14028 — so this has stopped being an unusual demand. That matters for the negotiation: you are asking for what the market is converging on, not for a favour. ## Lever two: represent the gap honestly What you must not do is let the appliance vanish from the inventory because it produced no findings. Record it as a component with the vendor as supplier, its product name and version, a hash of what you were shipped, and an explicit marker that identity is unresolved below that boundary. Two things follow from writing it down: - **Zero findings stops reading as safety.** An opaque component with no findings and a fully inspected component with no findings look identical in a dashboard, and they are not remotely the same. The marker is what keeps the difference visible to whoever reads the report next. - **The residual risk becomes ownable.** An accepted-risk entry with a named owner and a review date is a decision. The same situation with no entry is a decision too, taken by nobody, revisited never. ## Lever three: spend on containment instead If you cannot see inside the box, reduce what the box can reach. For an appliance holding customer data, the controls that pay are the ones that do not depend on knowing its contents: network segmentation and egress restriction, credentials scoped to exactly the data it needs and rotated on a schedule you control, authentication in front of its management interface, logging of its access to the data store into somewhere the appliance itself cannot alter, and a tested answer to "what do we do if this product is compromised" that does not require the vendor's cooperation on the day. ## Deciding where to fight The principal-level judgment is allocation. An estate has many vendors and finite negotiating capital. Tier them by what the product holds and what it can reach: an appliance sitting on customer data with broad network access earns a hard contractual conversation and, if that fails, a replacement plan; a self-contained tool touching nothing sensitive earns an inventory entry and no further spend. Applying the same demand to every vendor exhausts the goodwill you need for the ones that matter, and applying it to none is how an unmatched component quietly becomes the least defended thing in the estate. The answer an interviewer is listening for has all three parts: the recognition that you cannot solve it technically, the specific thing you ask the vendor for, and the honest bookkeeping that keeps the gap visible while you wait.