Dragos Vulnerabilities Policy
Summary: Dragos published a vulnerability disclosure policy that gives vendors 28 days to acknowledge a reported flaw and confirms them, and sets a 90-day deadline from initial disclosure for publication of vulnerability information and mitigations. Dragos states it will disclose only to the original manufacturer, reserves CVE IDs when the vendor is not a CNA, and shares limited public details without exploit code, while full Vulnerability Assessment reports go only to select WorldView customers.
Bottom line: A 90-day clock means ICS owners may learn about flaws in the equipment running their physical processes on a fixed public timeline, whether or not the vendor has a patch ready - and the detailed analysis and mitigations sit behind a commercial WorldView subscription.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026