Blog Post
Beyond the Initial Assessment
How RESCALE Enables Continuous Security Assurance
A security assessment tells us what was known about a component at a specific moment. Static analysis can identify weaknesses in source code, dynamic testing can expose problems during execution, and hardware assessment can reveal risks that ordinary software testing may miss. Yet none of these checks can guarantee that the component will remain secure throughout its operational life. New vulnerabilities are disclosed continuously, and a dependency considered safe when a product was released may later become a source of risk. This is why RESCALE treats security assurance as an ongoing process rather than a one-time result. Its Continuous Security Assurance Platform keeps previously assessed components connected to updated vulnerability information. When a new issue is disclosed, the platform can check whether it affects a component or dependency already recorded in RESCALE and determine whether the associated security information needs to be updated.
Why One-Time Security Checks Are Not Enough
Modern digital products depend on a wide range of libraries, services, firmware packages, cloud resources, and hardware elements. Even when the product itself does not change, the information available about these dependencies may change significantly. A newly published CVE can alter the risk profile of a component that passed all relevant checks only a few months earlier. Repeating the entire assessment process whenever a new vulnerability appears would be costly and inefficient. RESCALE instead reuses the evidence that has already been collected. The platform compares registered component and dependency information with updated vulnerability data, helping organisations identify when an existing component may require further investigation.
This approach does not replace static or dynamic testing. Those assessments remain the foundation of the security evidence. Continuous assurance adds the ability to revisit that evidence when the wider threat landscape changes.
Connecting Components with Updated Vulnerability Information
The RESCALE Security Assurance component brings together several functions that support this continuous process. A local vulnerability database provides the platform with access to information used during assessment, while an update mechanism keeps it aligned with newly available records. The Security Engine then correlates those records with the assets and dependencies already represented in RESCALE. The platform also maintains the connection between a component, its Software Bill of Materials, and the related trusted records. When a new vulnerability is linked to a registered asset, the system can generate a structured notification containing details such as the vulnerability identifier, severity, description, affected component, and associated project.
This notification is passed into the wider RESCALE workflow so that the relevant vulnerability and trust information can be reviewed or updated. Users do not need to search manually through every SBOM or monitor multiple vulnerability sources independently. Instead, the platform helps connect newly disclosed risks with the components that may be affected. Continuous monitoring can also include events and logs from the RESCALE environment itself. Event Captors provide operational information that can help identify suspicious behaviour or conditions requiring further investigation. The purpose is not to replace a full incident-response process, but to ensure that important security changes are detected and communicated to the appropriate technical teams.
Improving Communication Between Platform Services
As the platform evolved, RESCALE also improved the way its services exchange security information. The first implementation relied on direct communication between the Security Assurance component and TrustOR. This created a strong dependency between the two services. A change, performance issue, or temporary failure in one component could immediately affect the other. The direct connection also needed stronger security protections. Communications containing vulnerability and component information must be protected against interception, manipulation, and unauthorised access.
The final version introduces RabbitMQ as a message broker between the services. Instead of depending on a single direct connection, notifications are placed in queues and processed asynchronously. If one service is temporarily unavailable, the message can remain in the queue until the receiving component is ready. This model makes the platform more resilient and easier to extend. Additional sources of vulnerability information or new notification consumers can be connected without redesigning the complete communication flow. Authentication and permissions can also be applied centrally at the broker, with further options available for TLS-protected connections and certificate-based authentication.
Security That Continues After Release
The Continuous Security Assurance Platform reflects a simple but important reality: a component that is secure today may not remain secure tomorrow. Assurance evidence must remain connected to the changing vulnerability landscape if it is to support reliable decisions over time.
By combining existing assessment results with updated vulnerability information, continuous monitoring, structured notifications, and more resilient service communication, RESCALE helps organisations keep their supply-chain security records relevant. Initial testing establishes the evidence, while continuous assurance ensures that the evidence does not become an outdated snapshot.