Tell customers four things: what you know so far, whether their data or service is affected, what you are doing, and when you will update them. Keep it factual, avoid guessing, and do not say you are unaffected until you have checked. Silence tends to generate more questions than an honest "still investigating."
Decide whether to write at all
Not every zero-day needs a customer message. Write one when customers could be affected, when they will ask anyway because the flaw is widely reported, or when a contract or law requires notice. If you only use the product on an internal tool with no customer data, a short answer ready for support is usually enough.
The four parts of a good notice
- What happened. Name the flaw in plain words and link to the vendor advisory. Do not speculate about attackers.
- Are you affected. Say yes, no or still checking. If you say no, be sure. A wrong "not affected" is worse than a late answer.
- What you are doing. Describe actions such as applying the fix, restricting access, or reviewing logs. Keep them concrete.
- What customers should do. Often nothing. If they must update a client, rotate a key or change a setting, give exact steps.
End with a time for the next update and a contact address.
A short template
Subject: Security update on [vulnerability name]
On [date] a vulnerability was reported in [product]. We use this product in [area]. We are [checking / not affected / affected] and are [action]. There is [no action / the following action] required from you. We will send our next update by [time].
Replace the brackets with facts you have verified. Remove anything you cannot back up.
Words to avoid
| Avoid | Say instead |
|---|---|
| "We are fully secure" | "We have applied the vendor fix to the affected systems" |
| "No customer data was accessed" (before checking) | "We have found no evidence so far and are still reviewing" |
| "Sophisticated attack" | Describe what happened |
Keep the sales and support teams aligned
Give support a one-page answer sheet with the approved wording. Ask sales not to improvise in emails. Mixed messages cost more trust than the flaw itself. If a customer sends a questionnaire in the middle of the event, answer with the same facts and the same date.
Where Safeguard fits
Safeguard keeps an inventory from SBOM and dependency scanning, which gives you a documented basis for saying "affected" or "not affected," and its compliance and evidence automation helps keep the supporting records together.
Try it yourself
Click through it at your own pace, or open it full screen.
See how an inventory answers whether a package is in your products.
Quick check
Should we say "not affected" right away?
Only if you have checked the inventory and know it is true. Otherwise say you are investigating and give a time for the next update.
Do we need legal review of the notice?
If personal data may be involved or a contract sets notice duties, yes. Pre-agree a fast review path before an event.
Last reviewed: 19 October 2026.
