Vulnerability Research
Vulnerability Disclosure Program Setup
We establish a process to receive, assess and respond to external vulnerability reports for your product. Each report is assigned an owner, a target response time and an outcome.
What it is
A vulnerability disclosure program is a documented process that allows researchers and customers to safely report vulnerabilities in your product. ISO/IEC 29147 covers receiving reports and publishing advisories. ISO/IEC 30111 defines how reported vulnerabilities are assessed and remediated internally. The program defines the scope, rules for researchers, contact address and target response times.
Scope
- Drafting the disclosure policy and scope
- Security contact address and security.txt file on your website (RFC 9116)
- Report intake, severity rating and owner assignment flow
- Fix and release planning process with product teams
- Security advisory template and CVE approach
- Policy for communicating with and crediting researchers
The need
When organizations need it
- If you offer products in the EU. From 11 December 2027, the Cyber Resilience Act requires a coordinated vulnerability disclosure policy and a contact address for reports.
- When a vulnerability reported by a researcher goes unanswered due to unclear responsibility.
- When enterprise customers ask about your vulnerability management process during supplier assessments.
Method
How we work
-
Current state
We determine where reports currently arrive, who reviews them and how they are resolved.
-
Policy and channel
We draft the scope, rules and contact address, ready for publication.
-
Internal process
We define triage criteria, owners and target response times with your product teams.
-
Rehearsal
We process a sample report end-to-end and address any bottlenecks.
Outcome
What you have at the end
You have a disclosure policy ready to publish, a working contact channel and an internal process with assigned owners. When a report arrives, responsibilities are clear.
Frequently asked questions
Is a disclosure program the same as a bug bounty?
No. A disclosure program defines the rules for receiving reports and does not involve payment. A bug bounty adds monetary rewards and works better once the disclosure process is established.
What should we use as the reporting channel?
A dedicated security email address and a policy published on your website are a good start. A security.txt file helps researchers find the address easily.
Who runs the program?
Your teams operate the program. We can support the technical assessment of incoming reports in the initial period.
Vulnerability Research
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting