Separate ownership without duplicating evidence
Maintain one authoritative public product record while associating watches, criticality, exposure, and planning actions with the correct client workspace.
Report in planning windows
Lead with the next 90, 180, and 365 days. Show what changed, why the client received the item, source confidence, and the verification still required before a purchase or migration.
Avoid alarm-driven upsell
Use neutral severity language and transparent scores. An expired date may be operationally low risk in an isolated lab, while a near-term security-support end can be urgent for an exposed critical service.
Make it operational
Follow the relevant product versions, assign their criticality and exposure, then let verified source changes update the planning record.
Start with five version units free