简体中文
EnglishHow DeployHub's Post-Deployment Vulnerability Detection Differs from Pre-Release Dependency Scanning
Updated
DeployHub's post-deployment vulnerability detection answers a different question than pre-release scanning. A pre-release scan tells you which dependencies exist in your codebase and whether any of them match known CVEs at build time. DeployHub instead uses SBOMs plus deployment evidence to show which vulnerable package versions are actually running on which production endpoints, and it keeps checking as new CVEs are disclosed after release. The distinction matters most when you need to know where a newly published CVE is live in production, not just whether a dependency appears somewhere in a repository.
The core difference: presence vs. running exposure
Pre-release scanning operates on source and build artifacts. It can flag that a library version with a known CVE is included, but it cannot tell you whether that version was deployed, to which environment, or whether the vulnerable code path is reachable in a live system.
DeployHub's platform is described as continuously monitoring software that has already been released, using SBOMs and deployment evidence to detect newly disclosed CVEs and show exactly where vulnerable packages are running. That is a mapping problem: package → version → deployment → endpoint.
| Dimension | Pre-release dependency scanning | DeployHub post-deployment detection |
|---|---|---|
| Primary input | Source code, manifests, build artifacts | SBOMs plus deployment evidence |
| Question answered | Is a vulnerable dependency present? | Where is the vulnerable version running? |
| Timing | Point-in-time, at build or PR | Continuous, after release |
| New CVEs disclosed later | Requires re-scan of code | Matched against live deployments |
| Output granularity | Repository or project | Endpoint at risk |
| Agent requirement | Varies | Agentless, per the platform description |
Why timing changes the result
The page cites 48,185 CVEs in one year, with more than 130 new vulnerabilities disclosed every day in 2025. That volume breaks the assumption behind one-time scanning: a clean scan at release does not stay clean. A dependency that was safe on deploy day can become vulnerable weeks later when a CVE is published.
DeployHub's model is continuous threat exposure management applied to production. Because it retains SBOM and deployment records, a newly disclosed CVE can be matched to the deployments that contain the affected package without rebuilding or re-scanning source. The practical result is a list of endpoints at risk rather than a list of repositories that might be affected.
The React Server Components example
The page uses a 2025 React Server Components vulnerability rated CVSS 10.0 to illustrate the gap. Applications could be vulnerable simply because they supported React Server Components, even if they did not explicitly implement Server Functions. Knowing a dependency exists is not enough; you need to know where the vulnerable version is running.
This is the case where pre-release scanning produces noise or false confidence. A scanner may flag the dependency broadly across many projects, while only some deployed instances actually run the vulnerable version. DeployHub's stated approach maps each vulnerability to the endpoint at risk, which narrows response to real exposure.
What "agentless" and "less noise" mean in practice
The platform is described as agentless post-deployment vulnerability defense built on the Ortelius open-source core. Agentless matters for coverage: you are not dependent on installing and maintaining an agent on every host before you get visibility.
"Less noise" follows from the same mapping logic. Instead of alerting on every dependency match, DeployHub reports vulnerabilities tied to running deployments. For a security team triaging 130+ new CVEs per day, the difference between "this package appears in 40 repos" and "this package is running on these 6 endpoints" is the difference between an investigation queue and an action list.
When each approach fits
Use pre-release scanning when your goal is preventing vulnerable code from entering the build, enforcing dependency policy, or gating pull requests. It is the right control at the development boundary.
Use DeployHub-style post-deployment detection when your goal is answering "are we exposed right now, and where?" after software is live — especially when you already produce SBOMs, operate many deployed services, or need to respond to newly disclosed CVEs without rebuilding everything.
The two are complementary rather than substitutes. Pre-release scanning reduces what gets deployed; post-deployment detection tells you what is actually at risk in what you already shipped. DeployHub positions itself on the second half of that chain, with SBOM intelligence, endpoint mapping, and DevSecOps pipeline integrations as the supporting pieces.