Coordinated Disclosure Posture
also called Disclosure Stance, Advisory Posture
The pre-agreed position on how much detail ships with a security fix and who controls the publication clock, decided before a finding arrives rather than during the argument with the finder.
A vendor patches a critical bug and says nothing specific, hoping customers update before anyone works out what changed. That works exactly as long as the vendor is the only party holding the details. When an external researcher found it and has a published policy of releasing full technical analysis on the day of the fix, the interval between your release and working exploit code is set by that researcher's policy, not by your customers' change windows - and a notice written for a normal patch cycle is then the wrong document.
The posture is the decision made in advance: what your advisories always contain, what triggers an out-of-band release, and what you will and will not ask a finder for. Teams that have not decided this in advance negotiate it under time pressure with someone who has already decided theirs.
Why it matters
A security advisory is read by an operator deciding what to do in the next hour, not by a researcher. The gap between those two readers is where most advisories fail: they describe the vulnerability class accurately and do not say whether this particular deployment is exposed, or what to do if the machine cannot be restarted today.
The cost of getting it wrong is concentrated. In most estates a small fraction of installations are internet-reachable and those carry nearly all the risk, so an advisory that lets a reader classify themselves in 30 seconds routes the urgency to the few hundred operators who need it and spares the rest - which is what keeps your severity ratings believed next time.
Implementation patterns
- Fixed version and the single action in the first line, before any narrative. An operator who reads one sentence must still patch the right thing.
- An exposure condition stated as a check, not a description: "reachable from the internet", "running the agent in privileged mode". It turns a severity score into a self-sort.
- A mitigation for operators who cannot restart now. A build server or a database has a queue on it; without this line, the most exposed machines get nothing actionable.
- A detection signal so a customer who patches on day three can answer whether they were hit in between.
- One canonical advisory URL that is updated, rather than a series of statements. Updates are diffable; statements are not.
- A written rule for whether you name the finder and the publication window. Naming both is a real trade-off and should not be improvised.
Industry example
In March 2024 JetBrains released TeamCity 2023.11.4 to fix CVE-2024-27198 and CVE-2024-27199. CVE-2024-27198 is an authentication bypass in TeamCity On-Premises scored CVSS 9.8 - network-reachable, no credentials, no user interaction - on a server that holds deployment credentials for everything it builds. Rapid7 reported the issues; Rapid7's published timeline states that JetBrains asked to release the patches privately and Rapid7 declined under its own disclosure policy. JetBrains' advisory named Rapid7 and said the full technical details would be published within 24 hours of the announcement. CISA later added CVE-2024-27198 to its Known Exploited Vulnerabilities catalogue, and JetBrains reported customers whose servers were compromised because they could not patch in time.
Failure scenarios
- Silent patching when a third party holds the details: customers learn the severity from the exploit write-up instead of from you, and arrive at your support channel angry and already compromised.
- Severity inflation. Marking routine issues critical trains customers to discount the ratings, so the one that matters is read at the same speed as the rest.
- No exposure condition, so every customer treats themselves as urgent, the emergency change process saturates, and the genuinely exposed installations queue behind the rest.
- Advisory published before the artefact is available in every distribution channel, leaving readers with urgency and no fix.
- Contradicting your own prior advisories on scope, which is the fastest way to lose the benefit of having published early.
Trade-offs
| Choose | Gains | Pays |
|---|---|---|
| Publish the finder's 24-hour window | Operators budget correctly and escalate internally | Attackers read the same sentence and plan around it |
| Say nothing about the clock | No free targeting information | Customers plan a normal patch cycle for a window closing tomorrow |
| Full technical detail in your own advisory | Defenders write detections immediately | Exploitation becomes cheaper for everyone who has not patched |
When not to use it
When you found the issue yourself and hold the only copy, you own the clock and compressing it voluntarily is self-harm: stage the rollout, notify large customers privately, and publish on your own schedule. When the product auto-updates or runs only as a managed service, the fix has usually landed before the advisory, and the document's job becomes reassurance plus a log-check procedure rather than urgency. And when exploitation needs authenticated access plus an unusual configuration, an urgent posture spends credibility you will need for the next CVSS 9.8.
Interview question
Q: You are the architect for an on-premises product. A researcher reports a pre-auth remote code execution bug, refuses to delay publication past your patch release, and your largest customers need three weeks to approve an emergency change. Write the first three lines of the advisory and tell me what you do about the three-week customers.
What a strong answer covers: the first lines are the fixed version, the single action and the exposure condition, in that order, because the reader may stop after one. For the slow customers, the answer is a mitigation that does not require the restart - a network control, a configuration change, a disabled endpoint - plus proactive direct contact for the subset you can identify as internet-reachable. A strong answer also says what it will not do: it will not ask the researcher again, because a disclosure policy you do not control is a constraint rather than a negotiation, and it will not inflate or deflate the rating to manage the conversation.
Quick check
Quiz: A finder will publish full technical details 24 hours after your patch. Which four things move to the top of the advisory? The fixed version and single action; the exposure condition; a mitigation for operators who cannot restart today; the detection signal.
Flashcard: What changes in an advisory when a third party controls the publication clock? It stops being a record and becomes an operational instruction with a deadline, so the reader must be able to classify their own exposure in 30 seconds.