Vulnerability Disclosure Program: Design and External Management
A VDP is no longer optional: NIS2 and the Cyber Resilience Act require it. We help you get it up and running within weeks and manage every report that comes in, without needing a dedicated in-house team.
An unmanaged disclosure channel is worse than not having one
Publishing a responsible disclosure policy is only the first step. If incoming reports go unanswered for days, if researchers get no acknowledgment, if critical vulnerabilities get lost in an email inbox with no process... the reputational damage can outweigh the benefit of having a VDP at all. Companies that publish a disclosure channel take on a responsibility: to respond seriously and quickly to those who help them become more secure. We take on that responsibility for you.
What managed VDP service includes
- Design of the Responsible Disclosure Policy
- Implementation of the report intake channel (form, secure email or platform)
- Management of every incoming report: acknowledgment, triage and response
- Researcher communication on your behalf with defined response times
- Coordination with your technical team to remediate validated vulnerabilities
- Coordinated disclosure process management (CVD / ISO 29147) if the researcher wants to publish
- Monthly reporting: report volume, validation rate, response times
- Compliance documentation for NIS2 and the Cyber Resilience Act
How we implement your VDP
- Diagnosis and policy design: We analyze your environment, define the VDP scope, draft the disclosure policy and agree the response SLAs. We follow the ISO 29147 coordinated vulnerability disclosure standard.
- Channel implementation: We set up the intake channel (encrypted form, secure email or integration with a specialized platform) and publish it in the right place: security.txt, security page, public policy.
- Triage operation: Every incoming report goes through our triage process: technical validation, severity classification, researcher response and handoff to the remediation team.
- Coordinated disclosure management: If a researcher wants to publish their finding, we coordinate the process: we agree the disclosure timeline, prepare the public communication and make sure the vulnerability is patched before it goes out.
What you get
- Responsible Disclosure Policy drafted and published
- Operational, secured report intake channel
- Full management of every incoming report
- NIS2 / CRA compliance documentation
- Monthly VDP activity report
- Complete log of every interaction with researchers
Who this service is for
- Companies subject to NIS2 that need a mandatory vulnerability disclosure channel
- Manufacturers of digital products affected by the Cyber Resilience Act
- Companies with informal disclosure programs looking to professionalize the process
- Startups that want to establish a VDP as part of their security culture from day one
- Companies that have received unsolicited vulnerability reports and need a process
- Public entities that need to comply with ENISA or INCIBE disclosure guidelines
Frequently asked questions about managed VDPs
Does NIS2 require me to have a VDP?
NIS2 requires essential and important entities to have mechanisms to manage and report vulnerabilities, which includes having a vulnerability notification channel. Although the directive doesn't explicitly use the term VDP, the most common way to meet this requirement is to implement a Vulnerability Disclosure Program. We help you assess exactly what your company needs.
How long does it take for the VDP to be operational?
Standard design and implementation of a VDP takes between 2 and 4 weeks: policy drafting, channel setup, testing and publication. If you need to accelerate it for an audit or compliance process, we can adjust the timeline.
What happens if we receive a critical vulnerability?
Critical reports have an immediate escalation channel. As soon as we identify a report with potential critical impact, we escalate it directly to the client's security lead —regardless of the time of day— and coordinate the emergency response. The SLA for critical reports is 4 business hours.
Can you help coordinate the public disclosure of a vulnerability?
Yes. If a researcher wants to publish their finding (CVE, blog post, conference talk), we manage the coordinated vulnerability disclosure (CVD) process following the ISO 29147 standard: we agree the disclosure timeline, coordinate with the researcher and prepare the necessary communications.