Vulnerability Reasonable Disclosure Policy

The Trellix Advanced Research Center team has a single goal in dealing with vulnerabilities —to shepherd the company and the security industry through a diverse and evolving set of threats, with the aim of exposing and reducing attack surfaces. This goal cannot be accomplished without trusted partnerships, industry-wide collaboration, and reasonable disclosure of vulnerabilities. The following criteria will serve as a methodology for vulnerability disclosures by Trellix.

Software-based vulnerabilities

Our priority is to engage the affected vendor as quickly as possible when we uncover an undisclosed vulnerability.

We will initiate an open dialogue with the affected vendor and provide as much detail as we can, including, when possible, proofs of concept, full exploits, and remediation details.

Once we have notified a vendor of a software vulnerability, we will allow up to 90 days for the vendor to provide a patch or other relevant fix for the issue. If the vendor has not responded within 90 days, we will publicly disclose the vulnerability. If the vendor issues a fix during the 90-day window, the Advanced Research Center team may bring forward its disclosure. The team may also take into account the time required for customer applications of the vendor mitigation. Our aim is to enable vendors to provide appropriate remediations to affected users while also pushing the industry toward better software practices and faster responses to critical security issues.

If a vendor has demonstrated “good faith” and actively works with Trellix as well as its internal remediation teams, we may grant an extension of up to 30 days, determined by the Advanced Research Center team.

In the rare case of active exploitation, the team may escalate the public disclosure timeline. We will work to communicate clearly on the disclosure timeline and level of detail with vendors in these scenarios.

If we discover another affected vendor later in the discussions, the Advanced Research Center team will determine whether to allow additional time before disclosure. Our ability to continue providing best-of-breed vulnerability research is highly dependent on our credibility in the industry. In certain scenarios, the team will publish extensive details and investigative findings to help the security community continue to mature. We believe strongly that this open and collaborative sharing process among Trellix, vendors, and the information security community is essential to reducing the impact of today’s ever-changing threats.

In unique scenarios, the Advanced Research Center team reserves the right to shorten or lengthen the disclosure window. We will make every effort to contact the affected parties in this unlikely event.

Hardware-based vulnerabilities

For hardware-related disclosures, Trellix recognizes a lengthier disclosure period may be appropriate, given the challenge of providing timely and effective replacement solutions for affected platforms.

The Advanced Research Center team will adopt a 180-day disclosure window for vulnerabilities in hardware that require hardware replacement or upgrades to fix. We encourage vendors to provide mitigations sooner.

Depending on the criticality and ubiquity of any affected hardware, the team will determine the appropriate level of disclosure for the public release of hardware-related vulnerabilities.

To report a vulnerability directly related to Trellix products or services, please follow the directions listed here:
https://kcm.trellix.com/corporate/index?page=content&id=KB95563

For any questions regarding vulnerabilities ATR is disclosing in non-Trellix products, please use the following email:
ATR_Vuln@Trellix.com