arXiv: The History Is the Detector: Executing CVE Patch History, End-to-End

This publication introduces a new technical framework for automating the analysis of Common Vulnerabilities and Exposures (CVE) patch histories. The core proposal is to use the full lifecycle of a software patch—from its initial commit to its final deployment—as a detection signal for security weaknesses. By treating the patch history itself as a data source, the framework aims to identify patterns that indicate incomplete fixes, regressions, or newly introduced vulnerabilities, moving beyond static scans of current code.

The primary audience is organizations that manage large software supply chains, including cloud service providers, enterprise software vendors, and critical infrastructure operators. Any compliance team responsible for vulnerability management under frameworks like the EU Cyber Resilience Act or NIS2 should pay attention, as the method suggests a more dynamic way to prove ongoing security diligence. It does not change current legal obligations but signals a shift toward continuous, history-based risk assessment.

Compliance teams should first assess whether their current patch management logs are structured enough to support this type of analysis. Next, they should monitor for industry adoption of this technique, as it may influence future audit expectations for demonstrating effective remediation. Finally, begin a pilot project to compare historical patch outcomes against known CVE disclosures to see if this approach reveals gaps in your existing vulnerability response process. No immediate regulatory filing is required, but proactive evaluation is recommended.