Bring in a coordinator when a flaw touches several vendors, when you and the reporter disagree, when the researcher is inexperienced or short of capacity, or when the impact could reach critical infrastructure. For one vendor and one cooperative reporter, you can usually handle it directly.
What the CERT guide lists
The CERT Guide to Coordinated Vulnerability Disclosure says reporter experience, capacity, and the number or nature of vendors all help decide whether a coordinator is needed. It also names disputes between reporters and vendors, the potential for major infrastructure impacts, and multi-party cases where components come from several organizations.
Decision table
| Situation | Coordinator? |
|---|---|
| One vendor, experienced reporter, clear fix | Usually not |
| Flaw sits in a shared library used by many products | Yes |
| Reporter and vendor disagree on severity or validity | Consider |
| Reporter has no contact path to the vendor | Yes |
| Possible effect on critical infrastructure | Yes |
| Vendor has gone quiet | Consider, after more attempts |
What a coordinator does
The guide describes the coordinator as the party that facilitates the response. In practice that means finding the right contacts, keeping parties synchronized, and helping set a disclosure date. It does not mean taking over your engineering.
Multi-party cases get risky fast
The guide warns that the more parties involved, and the longer the embargo lasts, the more likely a leak becomes. Point to point messaging also scales poorly with many parties. If you expect more than a handful of recipients, agree on one channel and one timeline.
When the vendor is silent
The guide's advice is to assume good faith first. Silence is often a priorities problem rather than bad intent, so keep trying to reopen contact before escalating. Our post on researcher follow-up when a vendor does not reply lays out a sequence.
If you are the vendor
Say yes to a coordinator when a shared component is involved. Tell the coordinator your fix date, supported versions, and who else should know. Keep the number of people with details small. Our coordinated disclosure guide and the CERT/CC origin story give background.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how a newly disclosed issue spreads across many components, which is the multi-party situation a coordinator exists for.
Quick check
Do I need a coordinator for every report?
No. A single vendor with a cooperative reporter can usually handle it directly.
Why do embargoes with many parties leak?
The guide notes the more parties and the longer the embargo, the more likely a leak. Keep both small.
Safeguard's zero-day discovery and reachability analysis help you judge how a shared component affects you. A free scan is a good first step.
Sources
Last reviewed: 19 October 2026.
