The CERT Guide to Coordinated Vulnerability Disclosure names six phases: discovery, reporting, validation and prioritization, remediation, public awareness, and deployment. The guide calls the whole thing a process, not an event. For a product team, most of the work sits in the middle phases, and deployment is where users actually become safe.
The six phases
| Phase | What happens | Usual owner |
|---|---|---|
| Discovery | A researcher finds a flaw using tools and processes | Finder |
| Reporting | The researcher sends a report to the vendor or a coordinator | Finder or reporter |
| Validation and prioritization | An analyst confirms it and ranks it against other reports | Vendor |
| Remediation | A plan, ideally a tested patch, is developed | Vendor |
| Public awareness | The flaw and its fix are disclosed | Vendor, sometimes finder |
| Deployment | The fix is applied to running systems | Deployer |
The guide adds that finders and reporters are often the same person.
What a vendor should have ready
For each phase, one concrete thing:
- Reporting: a monitored address or form, published where researchers look.
- Validation: a named person who replies within a time you state.
- Remediation: a branch process that does not leak details early.
- Public awareness: an advisory template and a release note habit.
- Deployment: a way to tell customers a patch exists and how to apply it.
The phase teams skip
Deployment is the one many vendors treat as someone else's problem. A fix nobody installs protects nobody. Include upgrade instructions, tell customers directly when you can, and make the patched version easy to find. See notify downstream before disclosure.
Where timelines fit
Timelines are a choice about the gap between reporting and public awareness. The guide describes the options and tradeoffs without picking a number for you. Our posts on disclosure deadlines and the CERT/CC origin cover common conventions.
Try it yourself
Click through it at your own pace, or open it full screen.
Follow a finding from detection through remediation and see how the later phases look from the deployer's side.
Quick check
Which phase comes after remediation?
Public awareness, where the flaw and its remediation plan are disclosed, followed by deployment.
Who handles deployment?
The deployer, the party that must apply the patch or take other action. Vendors support them with clear advice.
Safeguard's autonomous remediation can propose fix PRs, off by default with every category on Manual, and a free scan shows your current exposure.
Sources
Last reviewed: 19 October 2026.
