On July 15, 2026, top cyber defense agencies across four allied nations released a joint guidance document: "Establishing a Coordinated Vulnerability Disclosure Program to Work with Security Researchers."
Co-authored by CISA and the NSA (United States), JPCERT/CC (Japan), NCSC-NL (Netherlands), and NCSC-UK (United Kingdom), the publication establishes a global baseline for how software developers and online service providers should interact with external security researchers.
Many software manufacturers and online service providers operating web services have internal teams that identify and address security vulnerabilities before releasing their products. However, internal efforts alone may be insufficient for discovering every potential vulnerability. To help pinpoint security defects not identified by internal testing, this guidance details how suppliers can harness the knowledge of external security researchers. Suppliers should engage these researchers by implementing a coordinated vulnerability disclosure (CVD) program.
So, what does this actually mean for security leaders, product teams, and software vendors?
Historically, white-hat security researchers who discovered vulnerabilities faced legal threats or retaliation under broad anti-hacking laws such as the Computer Fraud and Abuse Act (CFAA) in the U.S.
The joint guidance asserts that an effective Vulnerability Disclosure Policy (VDP) must include explicit "safe harbor" provisions. Organizations are instructed to provide legal assurances that good-faith research aligned with the VDP is authorized, will not result in legal action, and will be defended by the company if targeted by a third-party lawsuit.
Sample Safe Harbor Provision (Joint Guidance):
"If you make a good-faith effort to comply with this policy during your security research, [SUPPLIER NAME] will consider your research to be authorized... and will not recommend or pursue legal action related to your research."
The authoring agencies directly challenge stealthy security practices that obscure risk from end-users.
-
No silent fixes: Silently patching a vulnerability without mentioning its existence in release notes leaves customers unaware of their exposure window.
-
No blanket NDAs: Forcing researchers into non-disclosure agreements or restrictive gag orders damages trust and prevents broader industry learning.
-
Public transparency: Suppliers should publish machine-readable security advisories (such as CSAF) and issue Common Vulnerabilities and Exposures (CVE) identifiers for both externally reported and internally discovered vulnerability classes.
The joint guide outlines a procedural checklist for building a compliant CVD workflow:
-
Publish a VDP & security.txt file: Discovery & ingestion
-
Acknowledge and triage: Target 2-3 business days
-
Remediate & assign CVE IDs: Fix & validate
-
Coordinate public disclosure: Coordinated release
Host an unrestricted, public Vulnerability Disclosure Policy (VDP) on your website. Deploy an RFC 9116-compliant security.txt file to give researchers a standardized, machine-readable contact vector.
Set up a dedicated ingestion team (separate from standard customer support channels to prevent leaks or dropped reports). Acknowledge receipt within 2–3 days and use decision frameworks like SSVC (Stakeholder-Specific Vulnerability Categorization) to assess technical risk.
Develop patches or mitigations and share them back with the researcher for verification. Assign CVE IDs with detailed root cause mappings (CWE) and CVSS v4.0 metrics. If your organization isn't a CVE Numbering Authority (CNA), apply to become one.
Establish a reasonable remediation timeline with the researcher. Simultaneously issue the patch, release public security advisories (preferably using CSAF), and credit the researcher for their work.
While the guide offers best practices, global regulatory frameworks are rapidly turning these recommendations into mandatory compliance benchmarks.
-
U.S. Binding Operational Directive 20-01: Requires U.S. Federal Civilian Executive Branch agencies to develop and publish clear vulnerability disclosure policies.
-
EU Cyber Resilience Act: Requires software suppliers operating in the European Union to maintain documented vulnerability disclosure policies.
-
CISA Secure by Design Pledge: Encourages software manufacturers to publicly commit to launching vulnerability disclosure programs and reducing recurring vulnerability classes.
What should software suppliers do next?
If your organization develops commercial software, open-source tools, or manages internet-facing web applications, the global security community expects you to act.
-
Audit your entry points: Ensure researchers can easily reach your security team without hitting customer support walls.
-
Review legal language: Work with internal counsel to implement clear legal safe harbor language.
-
Leverage intermediaries when needed: If your internal team lacks the capacity to handle report triage, leverage national CSIRTs (like CISA or JPCERT/CC) or third-party bug bounty coordinators to manage the process.
By establishing a transparent CVD program, vendors turn external security researchers from potential legal adversaries into powerful force multipliers for product security.
