Reporting Security Issues to Dragos
Summary: Dragos published a vulnerability disclosure policy inviting security researchers to privately and responsibly report flaws in the Dragos Platform, Hardware, Services, and Threat Intelligence solutions, with submissions sent to a single designated email address and one finding per submission. The policy sets a 90-day disclosure window, requires researchers to stop testing and notify Dragos immediately upon finding sensitive data such as PII or trade secrets, and states Dragos may share reports affecting all users with CISA under its coordinated disclosure process.
Key Takeaway: The policy commits Dragos to a 90-day clock before public disclosure and allows reports to be submitted anonymously, with names and contact information not shared without express permission - terms that shape how much time an OT vendor gets to fix a flaw before it becomes public.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026