Chapter 1. Introduction to Vulnerability Management Certification policies

Red Hat offers Vulnerability Management Certification to commercial security vendors that provide container image vulnerability scanning solutions intended for use with Red Hat platforms.

The Red Hat Vulnerability Management Certification Program provides a formal process to verify that partner security solutions correctly use Red Hat-provided security data for Red Hat products. This includes CVE metadata, severity ratings, exploitability information (CSAF-VEX), and remediation advisories (RHSA).

Red Hat works directly with partners during the certification process to review scanner behavior, metadata handling, and report formatting. Certified products are listed in the Red Hat Ecosystem Catalog, helping establish technical alignment and assurance within the Red Hat ecosystem.

The certification process enables partners to confirm that their vulnerability scanning solutions meet Red Hat standards for accuracy, compatibility, and security when assessing Red Hat-published container images and packages.

Red Hat customers benefit from trusted security tools that are tested and jointly supported by Red Hat and the partner, helping them maintain a secure and compliant container environment.

To conduct a certification review, submit the vulnerability scan results in a standardized CSV format with the following required fields:

In addition, the following fields are optional, but will greatly help with the Certification review :

The following example illustrates the recommended CSV format: