Trellix Introduction Video
Trellix Introduction

A living security platform with a pulse that is always learning and always adapting.

Gartner Magic Quadrant for Endpoint Protection Platforms
Gartner MQ (Endpoint)

Download the Magic Quadrant report, which evaluates the 19 vendors based on ability to execute and completeness of vision.

Gartner Marketplace Guide (XDR)
Gartner® Report: Market Guide for XDR

As per Gartner, "XDR is an emerging technology that can offer improved threat prevention, detection and response."

Trellix Threat Labs Research Report: April 2022

Trellix Threat Labs Research Report: April 2022

Our report on the rise of cyberattacks in the fourth quarter and Ukraine in the start of the new year.

Cyberattacks Targeting Ukraine and HermeticWiper Protections

Cyberattacks Targeting Ukraine and HermeticWiper Protections

Analysis from the Trellix Advanced Threat Research (ATR) team of wipers deployed in Ukraine leading to likely connection between Whispergate, and HermeticWiper.

Trellix CEO

Our CEO on Living Security

Trellix CEO, Bryan Palma, explains the critical need for security that’s always learning.

Trellix Introduction Video
Trellix Introduction

A living security platform with a pulse that is always learning and always adapting.

Vulnerability Reasonable Disclosure Policy

The Trellix Advanced Threat Research team has a single goal in dealing with vulnerabilities —to shepherd the company and the security industry through a diverse and evolving set of threats, with the aim of exposing and reducing attack surfaces. This goal cannot be accomplished without trusted partnerships, industry-wide collaboration, and reasonable disclosure of vulnerabilities. The following criteria will serve as a methodology for vulnerability disclosures by Trellix.

Software-based vulnerabilities

Our priority is to engage the affected vendor as quickly as possible when we uncover an undisclosed vulnerability.

We will initiate an open dialogue with the affected vendor and provide as much detail as we can, including, when possible, proofs of concept, full exploits, and remediation details.

Once we have notified a vendor of a software vulnerability, we will allow up to 90 days for the vendor to provide a patch or other relevant fix for the issue. If the vendor has not responded within 90 days, we will publicly disclose the vulnerability. If the vendor issues a fix during the 90-day window, the Advanced Threat Research team may bring forward its disclosure. The team may also take into account the time required for customer applications of the vendor mitigation. Our aim is to enable vendors to provide appropriate remediations to affected users while also pushing the industry toward better software practices and faster responses to critical security issues.

If a vendor has demonstrated “good faith” and actively works with Trellix as well as its internal remediation teams, we may grant an extension of up to 30 days, determined by the Advanced Threat Research team.

In the rare case of active exploitation, the team may escalate the public disclosure timeline. We will work to communicate clearly on the disclosure timeline and level of detail with vendors in these scenarios.

If we discover another affected vendor later in the discussions, the Advanced Threat Research team will determine whether to allow additional time before disclosure. Our ability to continue providing best-of-breed vulnerability research is highly dependent on our credibility in the industry. In certain scenarios, the team will publish extensive details and investigative findings to help the security community continue to mature. We believe strongly that this open and collaborative sharing process among Trellix, vendors, and the information security community is essential to reducing the impact of today’s ever-changing threats.

In unique scenarios, the Advanced Threat Research team reserves the right to shorten or lengthen the disclosure window. We will make every effort to contact the affected parties in this unlikely event.

Hardware-based vulnerabilities

For hardware-related disclosures, Trellix recognizes a lengthier disclosure period may be appropriate, given the challenge of providing timely and effective replacement solutions for affected platforms.

The Advanced Threat Research team will adopt a 180-day disclosure window for vulnerabilities in hardware that require hardware replacement or upgrades to fix. We encourage vendors to provide mitigations sooner.

Depending on the criticality and ubiquity of any affected hardware, the team will determine the appropriate level of disclosure for the public release of hardware-related vulnerabilities.

To report a vulnerability directly related to Trellix products or services, please use this address:
security_report@trellix.com

For any questions regarding our public disclosure policy of external vulnerabilities, please use this address:
ATR_Vuln@Trellix.com