CISA urges software vendors to formalize vulnerability disclosure pro…

CISA and four international cybersecurity agencies have published guidance urging software vendors to establish formal coordinated vulnerability disclosure (CVD) programs, with structured processes for receiving and responding to security researcher reports. The guidance supports CISA's Secure by Design initiative and addresses the operational challenge of managing increasing volumes of AI-assisted vulnerability discoveries. If you ship software, you now need a published vulnerability disclosure programme or face regulatory pressure and reputational risk - this guidance from five governments is the de facto standard. The volume of AI-discovered flaws means you can't manually triage them all; you need process automation and attack-path analysis, not just severity scoring.