An incentive vacuum undermines responsible disclosure. For CISOs, this gradually becomes a risk management nightmare. Responsible disclosure is based on the assumption that “doing the right thing” will be met with a timely response, fair treatment, and professional respect—if not reward through a bounty. Increasingly, however, that assumption is breaking down. And when that happens, organizations alienate researchers and create regulatory, legal, and reputational risks.
See also: CISOs 2026: 3 ways to avoid downtime risk
In recent years, security researchers have been forced to wait months — sometimes more than a year — for companies to responsibly acknowledge disclosed vulnerabilities, while the same gaps continue to silently expose customers to risk. In several cases, frustration with silence, disagreements over severity, or changing subject matter restrictions have led researchers to public disclosure, legal action, or questionable behavior that companies later characterized as blackmail.
As vulnerability reporting becomes slower, more bureaucratic, and less rewarding, the lines between collaborative research and adversarial pressure are blurring. For CISOs, this is no longer an ethics issue; it’s a governance and risk management issue.
See also: The importance of frequency in cyber risk assessments
In many disputes, the disclosure process breaks down not because there is no vulnerability, but because demonstrating real-world impact requires analysis tailored to specific contexts — analysis for which neither side has earmarked resources.
Researchers are asked to develop realistic PoCs, demonstrate exploit chains, or verify hypotheses in configurations they don't control. Maintainers are asked to estimate usage patterns at lower levels of the chain, far beyond the original design scope. Both end up doing system-level analysis without any compensation.
See also: EU: Cybersecurity review and exclusion of dangerous suppliers
Preservationists have reason to react to low-value reports. Researchers have reason to feel that the bar for meaningful engagement is constantly rising. But the system offers no obvious mechanism to absorb this cost.
