Topic starter
20/08/2026 5:32 pm
TL;DR: A vulnerability disclosure policy can reduce missed reports, clarify scope, and create legal safe harbour, according to INTIGRITI. Its survey data shows 70% of researchers have found vulnerabilities at organisations without a VDP and 44% of those risks may remain undetected, while the governance problem is not just intake, but whether external reporting can be trusted, triaged, and closed at scale.
Editorial analysis by NHI Mgmt Group, based on content published by INTIGRITI: “The ultimate guide To VDP: How to write a vulnerability disclosure policy”.
By the numbers:
- 70% of researchers say they have found a vulnerability for an organisation that does not have a VDP, according to Intigriti research cited by INTIGRITI.
- 44% of the risks in that group potentially remain undetected, according to Intigriti research cited by INTIGRITI.
Key questions
Q: What breaks when an organisation has no vulnerability disclosure policy?
A: Reports arrive through inconsistent channels, researchers hesitate to escalate findings, and security teams lose visibility into exposures that should be remediated quickly.
Q: Why do legal safe harbour terms matter in vulnerability disclosure?
A: Safe harbour matters because it reduces the fear that a researcher will be punished for reporting responsibly.
Q: How should security teams standardise vulnerability report intake?
A: Teams should define the minimum fields needed to validate a report, then keep the form lean enough that researchers will actually use it.
Practitioner guidance
- Define in-scope assets and test boundaries List the systems, products and behaviours researchers may test, and state what is explicitly out of scope, including disruption and privacy-violating activity.
- Publish safe-harbour language that is plain and specific State that good-faith research conducted within policy will not trigger civil action from the organisation, and explain how third-party complaints will be handled.
- Standardise the report intake template Ask for only the fields needed to validate a finding, such as affected asset, reproduction steps, contact details and any proof the researcher can share.
Bottom line: A vulnerability disclosure policy is a governance control for external security reporting, not just a public-facing policy page.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:19 pm
VDP failure is a governance failure, not an intake failure: the core problem is whether an organisation has created a trusted path from discovery to remediation. If researchers cannot determine scope, reporting route or legal protection, the organisation has no reliable mechanism for converting external findings into security action. That makes disclosure a control boundary issue, not a communications exercise.
A question worth separating out:
Q: Why do public vulnerability disclosures create governance problems for security teams?
A: Because the response depends on multiple controls at once: asset knowledge, change ownership, patch authority, and verification. If any of those are unclear, the organisation can detect the issue without being able to act quickly enough. That is why vulnerability governance should be treated as an operating model, not a one-off technical task.
👉 Read our full editorial: Vulnerability disclosure policies expose the governance gap in security reporting