Vulnerability disclosure programs remain a blind spot for too many organizations—and frontier AI could soon make vulnerability discovery far easier and more frequent. New CISA and NSA guidance outlines practical steps for building effective coordinated vulnerability disclosure programs.
Adoption of the vulnerability disclosure program is still not quite guaranteed, but is poised to create a ripple effect across the broader cybersecurity market if it is. It is highly likely to push broad adoption of vulnerability disclosure programs (VDPs).
EU’s Cyber Resilience Act’s vulnerability disclosure terms would require that the government be notified within 24 hours of discovery even if the vulnerability has not yet been patched or had solid mitigation measures developed for it.