Support with the CVD process

Handling vulnerability reports can be a challenging process. That is why we offer organisations support to manage this Coordinated Vulnerability Disclosure (CVD) process effectively and efficiently.

Whether you have a CVD policy in place or have received a report from a bounty hunter or ethical hacker, we are ready to assist you with the technical assessment and handling of reports.

Technical assessment

When a report comes in, it is important to evaluate it. We verify whether the reported vulnerability is actually present and whether sufficient (technical) information has been provided.

Risk analysis

We help you assess the risks associated with the vulnerability. Based on our analysis, we provide additional recommendations where possible to reduce the impact and minimise potential consequences for your organisation.

Remediation advice

In addition to assessing the vulnerability, we also advise on possible solutions. We help you identify the most effective measures to protect your systems against potential attacks.

Communication guidance

We can support you in communicating with security researchers.

To inform security researchers (such as volunteers or those acting through national cybersecurity organisations) in a uniform and timely manner about the preferred contact method and contact details, we recommend implementing a security.txt text file. Alongside the benefits, there are however some potential drawbacks to consider. Implementation may unintentionally act as an encouragement, potentially resulting in a higher volume of reports. There is also the risk of incorrect or unfounded reports, which can lead to unnecessary workload.