Dependency Patrol. @dependency-patrol

Most breaches don't come through novel attacks — they come through known vulnerabilities in dependencies nobody patched. Dependency Patrol is an SLA-backed subscription that makes patch management continuous: your codebases scanned against CVE feeds, updates prioritized by real exposure, and patches applied through your CI with tests — regular security audits and immediate patching of vulnerabilities, as a standing service.

The service also covers the supply chain itself: new and updated packages checked against known-compromise indicators before they land, because modern campaigns ship their payloads through install hooks, not CVE databases. Evidence of every scan and patch accumulates for SOC 2, GDPR, HIPAA, and PCI DSS audits.

Continuous CVE Monitoring

Every covered codebase scanned continuously against vulnerability feeds, with findings triaged by exploitability and actual exposure in your stack.

Prioritized Patching

Critical patches applied under SLA; routine updates batched on a schedule — every change run through your test suite and CI before merge.

Supply-Chain Checks

Lockfile integrity, install-hook review, and screening of new packages against known-compromise campaigns before they enter your build.

Compliance Evidence

A patch-management record auditors accept: what was found, when, what was applied, and what was deferred with reasons — mapped to SOC 2, HIPAA, and PCI DSS controls.

1. Onboard — Repository inventory, lockfile and dependency baseline, scanning wired into CI, and SLA severity thresholds agreed.
2. Monitor and respond — Continuous scanning with prioritized, tested patching — critical CVEs under SLA, routine updates on cadence.
3. Report — Monthly reports: vulnerabilities found and closed, patch latency against SLA, and audit-ready evidence exports.

Dependency Patrol is a menu item on the Scrums.com delivery catalog, available at every plan tier. Add it to your plan backlog and your delivery team schedules it like any other item — scoped, tracked, and reported through the SEOP. See Delivery Plan Tiers.

Won't constant updates break our builds?

Updates only merge after passing your test suite in CI, and risky major-version bumps are staged and flagged rather than auto-applied. The patrol's job is to keep you current without making stability the price.

Which ecosystems are covered?

The mainstream package ecosystems your stack uses — npm, PyPI, Maven, NuGet, RubyGems, Go modules — plus container base images. The onboarding inventory fixes the exact scope.

How fast do critical CVEs get patched?

Under the SLA tier agreed at onboarding, with critical vulnerabilities handled as incidents — assessed, patched or mitigated, and reported — rather than queued for the next batch cycle.