Skip to content

You handle vulnerability reports and coordinate cases with other organizations

You receive vulnerability reports, work them with vendors and coordinators, and publish when the case is ready. You might be a security researcher, a vendor's product security team, or a coordinator at a national Computer Security Incident Response Team (CSIRT). You might also lead a Product Security Incident Response Team (PSIRT) or a CSIRT and need to decide whether to adopt Vultron; the first section below is written for that decision, and Prepare your program covers what adopting it asks of you. This page is a reading path through the parts of this site that describe how a Coordinated Vulnerability Disclosure (CVD) case works under Vultron. Each section builds on the ones before it; read a numbered list in order and a bulleted list in any order.

Decide whether it solves a problem you have

  1. What Is Vultron? — what kind of thing Vultron is, and what it leaves to your organization.
  2. What Does Success Mean in CVD? — the outcomes a case is trying to reach, stated independently of any tool.
  3. CVD Roles and Participants — the vocabulary the rest of the site uses for participants, reports and cases.

You can stop here if this section answered your question.

See how a case moves

  1. A Case Under Vultron — the case from your seat: who owns it, what you see and control, and what an embargo invitation asks of you.
  2. Vultron Process Models — the three processes a case runs: report handling, embargo, and case state.
  3. Embargo Principles — what an embargo is for and what it asks of each participant.
  4. Negotiating Embargoes — how participants propose, accept and revise an embargo.
  5. Adding Participants to an Embargoed Case — what happens when another party joins mid-case.
  6. Early Termination — when and how an embargo ends before its planned date.

Prepare your program

  1. How to Adopt Vultron in Your CVD Program — name your roles, choose a conformance claim, map your intake to the report states, publish your embargo defaults, and decide which judgment calls stay yours.

Map it onto what you already do

  • Standards Crosswalks — how the protocol lines up with the International Organization for Standardization (ISO) standards for vulnerability handling, disclosure, and multi-party coordination.
  • User Stories — the practitioner needs the protocol was designed against.
  • Interactions Between the Vultron Protocol and SSVC — where a Stakeholder-Specific Vulnerability Categorization (SSVC) decision enters a case.
  • Capability Model — every decision Vultron leaves to your organization, and where your answer plugs in.
  • How to Measure Your CVD Program — score your own cases against the chance baseline, and read the result as a skill indicator you can act on.

Watch a case run