Is Vulnerability Disclosure Broken for CISOs?

Responsible disclosure is meant to give vendors time to fix flaws before details become public. Security leaders sometimes report that information arrives late, incomplete or unevenly, leaving them unsure which of their systems are exposed.

How disclosure is supposed to work

A researcher reports a flaw privately, the vendor develops a fix, and an advisory is published once patches are ready. Defenders then assess exposure and update affected systems.

Where gaps appear

Problems include vague advisories, differing severity scores, delayed notifications to customers and flaws fixed quietly without clear communication. Each gap makes it harder to prioritise work.

What security teams can do

Subscribe to vendor and government advisories, maintain an accurate asset inventory and use a consistent method to rank urgency. Knowing what you run is the foundation of any response.

Questions for vendors

Ask how they notify customers, how quickly they publish advisories and whether they provide indicators to check for exploitation. Include these expectations in contracts where possible.

Preparing for uncertainty

Assume some information will arrive late. Layered defences, rapid patching processes and good logging reduce the damage when details are incomplete.

Key takeaways

• How disclosure is supposed to work: A researcher reports a flaw privately, the vendor develops a fix, and an advisory is published once patches are ready. Defenders then assess exposure and update affected systems.
• Where gaps appear: Problems include vague advisories, differing severity scores, delayed notifications to customers and flaws fixed quietly without clear communication. Each gap makes it harder to prioritise work.
• What security teams can do: Subscribe to vendor and government advisories, maintain an accurate asset inventory and use a consistent method to rank urgency. Knowing what you run is the foundation of any response.
• Questions for vendors: Ask how they notify customers, how quickly they publish advisories and whether they provide indicators to check for exploitation. Include these expectations in contracts where possible.
• Preparing for uncertainty: Assume some information will arrive late. Layered defences, rapid patching processes and good logging reduce the damage when details are incomplete.

Putting it into practice

To apply this in your own organization, begin with a short assessment of where you stand on vulnerability disclosure process today. Write down who owns it, which tools are involved, and the single biggest gap. Fix the highest-risk gap first, assign a clear date, and review progress after thirty days. Share what you learn with the team so improvements stick, and document the decisions you make so new staff can follow them. Revisit the topic every quarter, because threats, tools, and business needs change quickly, and small regular adjustments are far easier than large emergency fixes.

Common mistakes to avoid

Many teams struggle with vulnerability disclosure process because they try to do everything at once, skip documentation, or treat it as a one-time project. Others rely on a single person who holds all the knowledge, or buy tools before defining the problem they need to solve. Avoid these traps by starting small, writing down simple procedures, spreading responsibility across the team, and checking results on a regular schedule. If something is not working, adjust quickly instead of abandoning the effort, and keep a short log of what you changed and why. That record makes future decisions faster and helps new colleagues understand the reasoning behind your approach.

Frequently asked questions

What is a CVE?

A CVE is a public identifier assigned to a specific known vulnerability so everyone can refer to it consistently.

How fast should we patch?

Prioritise internet-facing systems and flaws known to be exploited, often within days.

Final thoughts

Disclosure will never be perfect. Good inventories and quick patching keep security leaders in control even when information is thin.