The CERT Guide to Coordinated Vulnerability Disclosure defines five main roles: finder, reporter, vendor, deployer and coordinator, plus others. A finder discovers the flaw, a reporter notifies the vendor, a vendor makes the product, a deployer applies the fix, and a coordinator helps the parties work together. One organization can hold several roles at once.
The roles in plain words
| Role | Definition | Typical duty |
|---|---|---|
| Finder | Identifies the vulnerability | Document it and share it responsibly |
| Reporter | Notifies the vendor | Send a clear, reproducible report |
| Vendor | Creates or maintains the vulnerable product | Validate, fix, publish |
| Deployer | Must apply a patch or other remediation | Act on the advisory |
| Coordinator | Facilitates the response | Connect parties, manage timing |
The guide notes finders and reporters are frequently the same entity.
You are probably several at once
A SaaS company that ships an open source library is a vendor for its own code and a deployer for every dependency it uses. If an engineer finds a bug in a third party package, the company is briefly a finder and reporter too. Knowing which hat you wear in a given case tells you what to do next.
What each hat means for your next move
- As a deployer, your job starts when an advisory appears: find where you use the component and patch. Your SBOM answers the first question quickly.
- As a finder, document steps, check for a policy, and report privately. Our researcher checklist helps.
- As a vendor, have an intake channel and a named responder. See what to do when a researcher emails you.
- As a coordinator, which is rare for a product team, keep parties informed and keep details limited to those who need them.
Where confusion hurts
Two failures show up often. A vendor treats a reporter as an attacker, and the reporter goes public. A deployer assumes the vendor will tell them, and nobody does. Name the roles in your policy, and say how deployers will hear about fixes.
A short exercise
Take your last three vulnerability events, one inbound report, one dependency advisory, one issue you found yourself. For each, write which role you held and whether you did that role's duties. Gaps usually point to the next process fix.
Quick check
Are finder and reporter the same role?
They are distinct roles, but one person or team often holds both.
What is a deployer?
The party that must apply a patch or take other remediation action, such as a customer running your software.
Safeguard's SBOM and dependency scanning helps you act as a deployer by showing where a component runs. You can start with a free scan.
Sources
Last reviewed: 19 October 2026.
