Research summarized by Anderson and Moore suggests disclosure tends to help over the long term. It speeds vendor fixes and, in the studies cited, reported vulnerabilities declined over time, though attacks rose at first. The answer depends on how many flaws remain and how often they are rediscovered.
The open question
Anderson showed in 2002 that under standard assumptions of reliability growth, open and closed systems are equally secure: opening a system helps attackers and defenders equally. So whether disclosure helps is an empirical question about how real software behaves.
The skeptical case
Rescorla argued in 2004 that in software with many latent vulnerabilities, removing one bug barely changes the chance an attacker finds another. Since exploits are often built by studying patches, he argued against disclosure and frequent patching unless the same flaws are likely to be rediscovered.
The evidence for disclosure
Two findings cut the other way. Ozment found that FreeBSD vulnerabilities are correlated, meaning they are likely to be rediscovered. Ozment and Schechter found that the rate of newly disclosed unique vulnerabilities in the unchanged core FreeBSD declined over six years. Together these suggest disclosure can improve security in the long run.
Arora and colleagues found that public disclosure made vendors respond with fixes more quickly. Attacks increased at first, but reported vulnerabilities declined over time.
What this means for a patching policy
The studies do not say patching is optional. They describe a short term cost and a long term gain, and they depend on rediscovery. For a defender:
- Assume details become public. Fixes often reveal the bug, so the window between a patch and attacks is short. See why vulnerability details appear before a patch and zero day versus n-day.
- Treat early disclosure as a countdown. The first days after publication carry the most pressure.
- Rank by exploitability. Not every disclosed flaw is reachable in your setup.
- Keep a routine. A steady patch cadence beats panic after each advisory.
What this means for your own disclosure process
If you receive reports, a clear policy and prompt fixes build trust. Vendors respond faster when disclosure is a real option, which is the incentive the research describes. See the vulnerability disclosure policy checklist.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how quickly a new disclosure turns into a decision about your own systems.
Quick check
Did the studies prove disclosure always helps?
No. They suggest a long term benefit with short term costs, and the result depends on how likely flaws are to be rediscovered.
Why did Rescorla argue against frequent patching?
He argued that with many latent bugs, fixing one changes little, while patches can help attackers build exploits.
Sources
Last reviewed: 19 October 2026.
