Summary
Throughout 2023, CISA focused on advocating for the increased agency adoption of the VDP Platform, supporting federal civilian executive branch (FCEB) agencies in identifying vulnerabilities in their systems, and engaging the security research community. Since launching in 2021, the VDP Platform has triaged over 12,000 submissions (over 7,000 in 2023) on behalf of 51 onboarded agency programs, saving agencies a significant amount of time and resources. Additionally, through the VDP Platform, over 2,400 unique, valid vulnerability disclosures have been identified, of which nearly 2,000 have been remediated by agencies. Since launch, over 3,200 security researchers have participated on FCEB VDPs via the VDP Platform. While the VDP Platform’s achievements are considerable, it is worth noting that vulnerability disclosure policies are only one component of a mature vulnerability management process.