Why Every Company Should Have a Vulnerability Disclosure Program

Why Every Company Should Have a Vulnerability Disclosure Program

Too often we see security researchers, whitehat hackers, IT leaders, academics, and journalists reach out to organizations upon discovering a vulnerability; only to find that they don’t have an obvious channel to receive such report. And if they do have a security@ email, they are too overwhelmed by the flood of unorganized submissions to act on them.

With hundreds of vulnerabilities found daily, it’s critical to provide an obvious way for external parties to report vulnerabilities. Risk management, industry and legislative pressures are driving the need to have a vulnerability disclosure program (VDP) in place to demonstrate commitment to security, and to better manage and reduce cybersecurity risk.

Listen to Bugcrowd Founder and CTO Casey Ellis and CSO David Baker for a discussion on :

• What is a vulnerability disclosure program
• The impact VDP is having on the industry
• Why implementing a VDP is no longer a nice-to-have, but a necessity