Vulnerability Research
Coordinated Vulnerability Disclosure
We report a vulnerability found in a product you use to the vendor through the correct channel with full technical details. We monitor the fix and publication timeline with the vendor.
What it is
Coordinated vulnerability disclosure is the process where a vulnerability is first reported to the vendor and made public once a fix is ready. The goal is to prevent users from being exposed without a fix. The report is sent to the vendor's security contact. If the vendor does not respond, a coordinator such as a national CERT can assist.
Scope
- Documenting the vulnerability so the vendor can reproduce it
- Identifying the vendor's security contact and making the initial report
- Expressing severity using CVSS
- Agreeing on the fix and public disclosure date with the vendor
- Requesting a CVE ID and preparing the advisory text if needed
The need
When organizations need it
- When a vulnerability is found in a product you use during a test or incident investigation.
- When the vendor's security contact is unclear or your initial report was unanswered.
- When you must continue using the product until the vulnerability is fixed and need to manage the risk in the meantime.
Method
How we work
-
Documentation
We turn the vulnerability into a technical report including affected versions, conditions, and impact.
-
First contact
We send the report to the vendor's security channel and follow up for acknowledgment and a responsible contact.
-
Timeline
We agree on the fix and public disclosure date with the vendor.
-
Publication
We verify the fix and support the advisory and, if needed, the CVE record.
Outcome
What you have at the end
The vulnerability is managed in a controlled way until the fix is published. Correspondence, dates, and interim measures are documented.
Frequently asked questions
Will our organization's name appear in the advisory?
This is your decision. If you prefer, the report can be made without naming your organization.
What if the vendor does not respond?
Support can be requested from a coordinator such as a national CERT. We decide on public disclosure together with you, considering the risk to users.
Do we also have to report the vulnerability to an authority?
In some jurisdictions, the law requires organizations providing IT services to report detected vulnerabilities to a national authority without delay. We coordinate with your legal counsel how this report is sequenced with the vendor notification.
Vulnerability Research
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting