A team wants to secure its software supply chain by automatically detecting known high-severity vulnerabilities in the open-source dependencies its projects consume. According to Microsoft's supply chain guidance, which capability should they enable?