A public buyer can ask a software vendor to commit to six things: how it takes flaw reports, how it rates them, how fast it fixes each rating, how it tells customers, what it does about exploited flaws, and what evidence it shares. Ask for terms you can check later.
Six terms to request
| Term | What to ask for | How you can check it |
|---|---|---|
| Intake | A public way to report flaws and a named team | Find the page and contact |
| Rating | The scoring method used | Compare to a past advisory |
| Fix targets | Target days to fix by rating | Review past advisories for dates |
| Customer notice | How and when customers are told | Ask for a sample notice |
| Exploited flaws | A faster path when a flaw is known to be used in attacks | Ask how they track exploitation lists |
| Evidence | Release notes, fixed versions, and an SBOM on request | Ask for a sample |
Make targets measurable
"Fix promptly" cannot be checked. "Release a fix or workaround within a stated number of days for the highest rating, measured from confirmation" can. Do not copy numbers from a blog. Ask the vendor what it can commit to and compare answers across vendors.
What to look at before asking
Read the vendor's past advisories. Look at the gap between report and fix, how clearly they describe affected versions, and whether they say what customers should do. Past behavior is better evidence than a policy page.
Exploited flaws deserve their own line
CISA's Known Exploited Vulnerabilities catalog is maintained by CISA as a source of vulnerabilities exploited in the wild, and CISA says organizations should use it as an input to their vulnerability management prioritization. Ask the vendor whether it tracks that list for its own components and how fast it acts on a match. See how to use the KEV catalog across many environments.
A short clause to bring to counsel
Keep language plain and give your counsel the draft:
"The vendor will maintain a public channel for reporting security flaws, notify customers of fixed flaws that affect supported versions, and provide on request a list of components and versions in each release."
What you give back
Terms work both ways. Be ready to say who at your organization receives notices, how fast you will apply updates, and which versions you run. A vendor cannot help if the notice goes to a mailbox nobody reads.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a fixed version is surfaced next to a finding, which is the kind of evidence a notice should point to.
Safeguard provides vulnerability scanning with fix pull requests that are off by default and kept on manual approval, which is one way a team can keep a human decision in the loop.
Quick check
Should I demand a specific number of days from every vendor?
Ask each vendor what it can commit to and measure the answer against its past advisories.
What is the best evidence of a vendor's response?
Its past advisories: dates, clarity of affected versions and the fix guidance.
Sources
Last reviewed: 19 October 2026.
