What to do when a vendor doesn't respond to security issues?

When a vendor fails to respond to security issues, your approach should be structured, strategic, and adaptable based on your relationship with the vendor (e.g., paying customer vs. external researcher). Here’s how to handle it:

1. Escalate Strategically

• ·Shift Channels and Audiences: If initial reports to generic addresses (e.g., security@) go unanswered, escalate to direct contacts like Account Managers, Customer Success, or the CISO. Use platforms like LinkedIn or professional email.
• ·Reframe the Issue: Present the flaw as a business or compliance risk rather than a technical bug. Mention contractual obligations, compliance standards (e.g., SOC2, ISO 27001), or financial impact to trigger urgency.

2. Mitigate the Risk Proactively

• ·Network Segmentation: Isolate the vendor’s product in a restricted VLAN to limit exposure.
• ·WAF/IPS Rules: Deploy custom rules to block known exploit patterns (e.g., SQLi, XSS).
• ·Access Controls: Use Zero Trust or VPNs with MFA to restrict authentication to the vulnerable system.

3. Leverage Contractual and Legal Pressure

• ·Review SLAs/MSAs: Check for patching timeframes or audit clauses. Issue formal breach notices if terms are violated.
• ·Evaluate Alternatives: If the vendor’s lack of response indicates poor security maturity, begin assessing competitors.

4. Responsible Disclosure (External Researchers)

• ·Set Deadlines: Give a clear window (e.g., 90 days) for response before public disclosure.
• ·Engage Mediators: Report to CNAs (CVE Numbering Authorities) or platforms like HackerOne if the vendor is registered.
• ·Publish Limited Disclosures: Share risks and mitigations without proof-of-concept details to protect users.

Decision Matrix