Hackrate Managed Vulnerability Disclosure Program (mVDP)

Security vulnerabilities are often discovered by external security researchers, customers, partners, and other third parties. Without a clear vulnerability disclosure process, these reports may be sent through inappropriate channels, remain unresolved, or create unnecessary security and communication risks.

Hackrate’s Managed Vulnerability Disclosure Program (mVDP) provides organizations with a structured and professionally managed process for receiving, validating, and handling externally reported security vulnerabilities.

This professional service supports organizations operating applications, APIs, cloud environments, and digital assets on Amazon Web Services (AWS). Hackrate mVDP can be used as a coordinated vulnerability disclosure channel for customer-controlled applications and workloads built on AWS services such as Amazon EC2, Amazon API Gateway, Amazon CloudFront, Elastic Load Balancing, Amazon S3, and other AWS services used to host, operate, or deliver customer applications.

Hackrate provides the vulnerability disclosure infrastructure and security expertise required to establish a clear communication channel between organizations and external security researchers. Submitted vulnerabilities are assessed and validated by Hackrate before actionable findings are communicated to the customer.

How It Works

1. Program Setup: Hackrate works with the customer to establish the Vulnerability Disclosure Program, define eligible applications and digital assets, determine the program scope, and establish vulnerability disclosure rules.

2. Disclosure Channel: A dedicated vulnerability disclosure interface enables security researchers and other external parties to securely report potential vulnerabilities affecting the customer’s applications and AWS-hosted workloads.

3. Vulnerability Triage and Validation: Hackrate security experts review submitted vulnerability reports, assess their technical validity and severity, request additional information from the reporter when necessary, and filter invalid or irrelevant submissions.

4. Coordinated Communication: Hackrate acts as an intermediary between the customer and the vulnerability reporter, helping maintain structured communication throughout the vulnerability handling process.

5. Reporting and Remediation: Validated findings are provided to the customer with technical information required to reproduce and understand the vulnerability. Hackrate can provide additional assistance during assessment and remediation.

Key Benefits

• Centralized Vulnerability Disclosure: Provide a dedicated and structured channel for reporting security vulnerabilities affecting your applications and digital assets.
• Professional Vulnerability Triage: Hackrate security experts assess, validate, and classify incoming vulnerability reports before they reach your internal teams.
• Reduced Security Team Workload: Filter spam, duplicate, invalid, and irrelevant submissions so internal security teams can focus on actionable vulnerabilities.
• Researcher Communication: Hackrate manages communication with external security researchers when additional information or clarification is required.
• AWS Workload Coverage: Use the disclosure program for customer-controlled applications, APIs, and digital assets hosted on or using AWS.
• Structured Reporting: Receive validated vulnerability information with technical details, severity assessment, and supporting evidence through the Hackrate platform.
• Enterprise-Ready Process: Establish a consistent vulnerability disclosure workflow that can support organizational security governance and vulnerability management processes.

Managed Vulnerability Disclosure

Unlike a bug bounty program, a Vulnerability Disclosure Program does not require organizations to actively incentivize security researchers to search for vulnerabilities. Instead, it establishes a secure and responsible process for vulnerabilities discovered independently by external parties to be reported and handled.

Organizations can use Hackrate mVDP as a standalone vulnerability disclosure capability or as a foundation before introducing more proactive security testing models such as private or public bug bounty programs.

Hackrate mVDP helps organizations establish a professional vulnerability disclosure process for their AWS-hosted applications and digital services while maintaining control over scope, communication, validation, and remediation.