Panel Discussion - The Risks of Requiring Premature Vulnerability Disclosures
summary
Governments increasingly mandate reporting unmitigated flaws to agencies (seen in the EU CRA, China’s rule, France’s law and FISMA proposals), requiring 24‑hour/72‑hour deadlines that force vendors to decide before patches exist; that creates a central buggy bank of secrets, risks weaponization (contrasted with the U.S. Vulnerabilities Equities Process), and burdens triage teams who must determine whether a report is actively exploited undefined while trying to build and deploy fixes.
AI-written summary · about
chapters (18)
- 0:00Vulnerability disclosure regulations
- 2:04Vulnerability incidents and threat intel
- 5:37Vulnerability disclosure processes
- 7:45Governments requiring vulnerability reports
- 10:54Risks of premature reporting
- 13:43Government use of vulnerabilities
- 16:55EU Cyber Resilience Act requirements
- 20:47Actively exploited vulnerability challenges
- 28:35Vulnerability response workflows
- 33:11Compliance burden with regulations
- 39:11Disparate reporting laws complexity
- 42:01Harmonizing vulnerability reporting
- 46:13Industry feedback on regulations
- 48:43Stakeholders in coordinated disclosure
- 50:13Contributions to policy discussions
- 53:28Lessons from large-scale vulnerability fixes
- 56:22Cross-company vulnerability reporting
- 57:24Closing remarks and Q&A
related talks
51mNo More Secrets in Cybersecurity: Implementing ‘Radical Transparency’
09mInterview
18mWhat You Need to Know and Do about Vulnerability Disclosure
39m"Vulnerabilities for Sale - The Good, the Bad and the Ugly"
11mVulnerability Supply Chains
48mHow to report a vulnerability: Responsible Disclosure for Developers
29mMake It Fixable: Preparing for Security Vulnerability Reports
01h 04mOpen Discussion - International Challenges with CVD, CNA, and CVE