When a security researcher finds a flaw in your software, you've got two paths: handle the disclosure yourself or let a third-party intermediary like CISA manage it. Recent joint guidance from CISA, NSA, and international partners outlines both options, but it doesn't tell you which one fits your organization. That decision depends on factors most security teams haven't mapped yet.
The Question at Hand
Should you build and maintain your own Coordinated Vulnerability Disclosure (CVD) program with a public vulnerability disclosure policy, or should you route external researcher reports through a third-party intermediary? The choice shapes how you triage vulnerabilities, assign CVE identifiers, communicate with researchers, and demonstrate security commitment to customers. It's not just a technical question. It's a resource allocation decision that affects your relationship with the security research community and your ability to remediate flaws before they're exploited.
The Case for Running Your Own CVD Program
Direct control over the disclosure process gives you ownership of the researcher relationship. When you publish a clear Vulnerability Disclosure Policy (VDP) on your website and maintain your own intake process, you control the timeline, the messaging, and the technical details shared at each stage.
You can customize your triage workflow to match your existing Software Development Life Cycle (SDLC) and change management processes. If your team already uses a ticketing system that feeds into sprint planning, you can route CVD reports directly into that pipeline. You assign CVE identifiers on your schedule, coordinate patches with your release calendar, and decide when to publish advisories based on your customer communication strategy.
This approach also signals maturity to enterprise buyers. A well-documented CVD program with a public VDP shows you're serious about product security. It's evidence you can point to during SOC 2 Type II audits when auditors ask about vulnerability management processes under the CC7.1 control. It demonstrates you've implemented a structured approach to external threat intelligence, which aligns with NIST Cybersecurity Framework functions like Identify and Respond.
You build direct relationships with researchers who specialize in your technology stack. Over time, you'll recognize repeat contributors and can establish private channels for complex findings. Some organizations offer bug bounties or recognition programs that turn researchers into an extended security team. That relationship doesn't develop when reports flow through an intermediary.
The Case for Routing Through Third-Party Intermediaries
Not every organization has the bandwidth to run a responsive CVD program. If you're a mid-market software vendor with a three-person security team, adding CVD triage to your workload means something else doesn't get done. Third-party intermediaries like CISA or national computer security incident response teams can substitute for or supplement your program without requiring you to hire additional staff.
These intermediaries bring established credibility with the research community. A researcher who's unsure whether your team will respond might submit through CISA instead, knowing the report will get tracked and escalated if you're unresponsive. You still get the vulnerability details, but the intermediary handles the initial communication, validates the report's legitimacy, and manages researcher expectations about timelines.
For organizations with limited security expertise, intermediaries provide guidance on remediation approaches and help coordinate disclosure timing across multiple affected vendors. If a researcher finds a library-level flaw that impacts your product and twelve others, CISA can coordinate a synchronized disclosure that gives everyone time to patch before details go public.
There's also a legal and reputational buffer. If a researcher threatens public disclosure before you've had time to remediate, the intermediary can negotiate on your behalf. If the researcher turns hostile or demands payment, you're not managing that confrontation directly. The intermediary's established policies and escalation procedures protect you from edge cases that could turn into PR incidents.
Where Practitioners Actually Land
Most organizations don't choose one approach exclusively. They run a basic CVD program for straightforward reports but use intermediaries for complex or sensitive disclosures.
A common pattern: publish a VDP with a security contact email, triage reports internally, but include language that researchers can also submit through CISA if they prefer. This gives you direct control over most reports while providing an alternative channel for researchers who don't trust your process or need third-party validation.
Some teams start with intermediaries and transition to self-managed programs as their security maturity increases. If you're still building out your vulnerability management framework or don't have a documented process for assigning CVE identifiers, routing through CISA buys you time to develop those capabilities without leaving researchers in limbo.
Enterprise software vendors with dedicated product security teams typically run their own programs but maintain relationships with intermediaries for cross-vendor coordination. They handle individual product flaws internally but engage CISA when a disclosure affects multiple vendors or critical infrastructure.
Our Take
If you're already running a Computer Security Incident Response Team with documented procedures for containment, eradication, and recovery, you should run your own CVD program. The capability overlap is significant. You're already triaging security events, coordinating remediation, and communicating with stakeholders under time pressure. Adding a VDP and a researcher intake process isn't a major lift, and it gives you control over a critical security input.
But don't pretend you can run a responsive program if you can't commit resources to it. A CVD program that takes six weeks to acknowledge reports damages your reputation more than having no program at all. If your security team is overwhelmed managing compliance audits and incident response, route disclosures through an intermediary until you can staff the function properly.
The tradeoff is direct researcher relationships versus operational bandwidth. We'd rather see you use CISA effectively than run a half-staffed CVD program that frustrates researchers and delays patches. But if you can dedicate someone to triage reports within 48 hours and maintain a public VDP with clear expectations, you'll build a stronger security posture and a better reputation with the research community.
Either way, document your choice in your vulnerability management procedures and make sure your legal team understands how disclosure coordination works. The worst outcome is discovering a researcher submitted a critical flaw through a channel nobody monitors.
