Security researchers can uncover vulnerabilities that suppliers’ internal testing misses, but reports routed through general customer-support channels may be overlooked, undervalued or accidentally disclosed, according to new joint guidance.
To address those gaps, five cybersecurity authorities and coordination bodies have set out a recommended process for coordinated vulnerability disclosure.
The July 15 joint guidance, issued by issued by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA) and counterpart agencies in Japan, the Netherlands and the UK, treats coordinated vulnerability disclosure as a product-security process. That process runs from the moment a report lands through legal authorization, remediation, common vulnerabilities and exposures (CVE) publication and executive review.
The message for suppliers: a researcher’s report is a leadership matter, not a help-desk ticket.
Defining the rules of engagement
The guidance starts where researchers do — with the rules of engagement. Software manufacturers and online service providers should publish a vulnerability disclosure policy defining testing scope, prohibited activity, minimum report content and secure submission methods.
The agencies also say organizations should consider accepting anonymous reports and should publish an RFC 9116 security.txt file so researchers can locate current contact details and a link to the policy.
The file is a discovery mechanism rather than the program itself. RFC 9116 requires “Contact” and “Expires” fields, while the “Policy” field can direct researchers to the organization’s disclosure rules.
The broader guidance then asks suppliers to define what researchers may test, limit exploitation to what is needed to confirm a flaw and prohibit activity such as copying data, introducing malware, social engineering or disrupting services.
The limits of safe harbor protection
The legal boundary is narrower than the phrase “safe harbor” can imply. The guidance’s sample language would have a supplier treat policy-compliant research as authorized, refrain from pursuing or recommending legal action and affirm that the research was authorized if a third party brings a case.
In the United States, the Justice Department’s Computer Fraud and Abuse Act (CFAA) separately tells federal prosecutors to decline prosecution when available evidence shows both good-faith conduct and intent. The same policy says it is internal guidance and creates no enforceable legal right or benefit. Then–Deputy Attorney General Lisa Monaco described computer security research as “a key driver of improved cybersecurity.”
Routing reports to engineering
Once a report arrives, the agencies recommend acknowledging it within a defined period, such as two to three business days, and keeping vulnerability triage outside general customer-support queues. Dedicated staff should assess product and user risk before deciding whether remediation must take priority over feature development or a regular release cycle.
The separation becomes especially important when research touches live customer environments. In June 2026, the handling of a ServiceNow unauthenticated-access issue involved bug-bounty submissions, activity affecting a subset of instances and further work to determine what customer data had been queried — just the kind of report a general support queue could misread as a routine ticket rather than a live data-exposure question.
Engineering should also search for other instances of the same weakness. Recurring vulnerability classes should reach senior leadership through metrics and trend reporting rather than remain isolated product defects.
Managing embargoes and public advisories
When a vulnerability proceeds to public disclosure, suppliers should produce an accurate and timely CVE record and advisory. The guidance calls for affected products and versions, root cause, severity, exploitation status, indicators of compromise, fixes and mitigations.
Those details allow downstream teams to identify exposure, as June 2026 coverage of an actively exploited Lantronix flaw demonstrated. “Long embargoes do not necessarily reduce risk,” the agencies wrote, recommending that suppliers and researchers adjust embargo periods collaboratively and disclose without undue delay.
Regulatory outlook and intermediary support
The document does not create a new legal requirement. CISA’s Binding Operational Directive 20-01 already requires U.S. federal civilian agencies to publish vulnerability disclosure policies (VDPs) for internet-accessible systems and maintain supporting processes.
The EU Cyber Resilience Act will apply broader product-security duties, including coordinated vulnerability-disclosure policies for manufacturers of covered products with digital elements, from Dec. 11, 2027. Its reporting provisions for actively exploited vulnerabilities and severe incidents apply from Sept. 11, 2026.
Suppliers without sufficient internal capacity may use national response teams or other intermediaries for intake, assessment, CVE assignment and disclosure. U.S. federal agencies can separately use CISA’s VDP Platform to receive, triage and route reports. CISA’s 2024 Year in Review says researchers using the platform enabled federal agencies to remediate over 861 vulnerabilities.
The guidance connects a public disclosure policy to the processes needed after a report arrives: engineering triage, remediation, customer communication and management review. It does not prescribe staffing levels, budgets or a single disclosure deadline for every vulnerability.