The point: Coordinated disclosure processes show limitations in securing zero-day vulnerabilities, making public disclosure under pressure a last-resort measure.
The traditional practice of coordinated vulnerability disclosure is coming under increasing scrutiny. Jürgen Schmidt, head of heise security, argues that Responsible and Coordinated Disclosure have lost their effectiveness.
The established practice of coordinated vulnerability disclosure (Responsible and Coordinated Disclosure) is based on the principle of informing vendors before public release — with the expectation that sufficient time remains to fix the issue. However, this model is increasingly under pressure, as Jürgen Schmidt, head of heise security, explains.
The challenge lies in practical implementation: during the coordination and remediation phase, vulnerabilities remain susceptible to potential attackers who could independently identify the security flaw. This is particularly true for zero-day vulnerabilities that have no publicly known exploitation method. Security researchers and organizations face a dilemma between protecting the public on one hand and granting vendors adequate remediation time on the other.
Prolonged disclosure can lead to vulnerabilities being deliberately exploited — for example by targeted attackers or organized cybercrime. At the same time, patience signals to vendors that time works in their favor. This imbalance causes Full Disclosure — immediate public disclosure without prior coordination — to increasingly appear as a legitimate strategy for security researchers — as a last resort against a system that proves ineffective.
For CISOs, this means a paradigm shift: the traditional assumption that coordinated disclosure primarily serves protection is increasingly being questioned. Instead, security leaders must prepare for a more chaotic disclosure environment in which surprises from public disclosure could become more frequent. This requires adapted incident response and patch management processes as well as heightened monitoring of security channels.
Source: www.heise.de · Published July 16, 2026
Lumi AI News — AI-assisted curation in accordance with Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.7.3.