{"id":"https://openalex.org/W4416415804","doi":"https://doi.org/10.1145/3777485","title":"Vulnerability Disclosure or Notification? Best Practices for Reaching Stakeholders at Scale","display_name":"Vulnerability Disclosure or Notification? Best Practices for Reaching Stakeholders at Scale","publication_year":2025,"publication_date":"2025-11-20","ids":{"openalex":"https://openalex.org/W4416415804","doi":"https://doi.org/10.1145/3777485"},"language":"en","primary_location":{"id":"doi:10.1145/3777485","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3777485","pdf_url":null,"source":{"id":"https://openalex.org/S4210235901","display_name":"Digital Threats Research and Practice","issn_l":"2576-5337","issn":["2576-5337","2692-1626"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Digital Threats: Research and Practice","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://doi.org/10.1145/3777485","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5060918068","display_name":"Ting-Han Chen","orcid":"https://orcid.org/0000-0001-8759-6676"},"institutions":[{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Ting-Han Chen","raw_affiliation_strings":["University of Twente, Enschede, The Netherlands","University of Twente, The Netherlands"],"raw_orcid":"https://orcid.org/0000-0001-8759-6676","affiliations":[{"raw_affiliation_string":"University of Twente, Enschede, The Netherlands","institution_ids":["https://openalex.org/I94624287"]},{"raw_affiliation_string":"University of Twente, The Netherlands","institution_ids":["https://openalex.org/I94624287"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5036733211","display_name":"Jeroen van der Ham","orcid":"https://orcid.org/0000-0002-5685-8714"},"institutions":[{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Jeroen van der Ham-de Vos","raw_affiliation_strings":["University of Twente, Enschede, The Netherlands","University of Twente, The Netherlands"],"raw_orcid":"https://orcid.org/0000-0002-5685-8714","affiliations":[{"raw_affiliation_string":"University of Twente, Enschede, The Netherlands","institution_ids":["https://openalex.org/I94624287"]},{"raw_affiliation_string":"University of Twente, The Netherlands","institution_ids":["https://openalex.org/I94624287"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I94624287"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.45392128,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"7","issue":"1","first_page":"1","last_page":"20"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.881600022315979,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.881600022315979,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.026399999856948853,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.01510000042617321,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.8658000230789185},{"id":"https://openalex.org/keywords/best-practice","display_name":"Best practice","score":0.8452000021934509},{"id":"https://openalex.org/keywords/scale","display_name":"Scale (ratio)","score":0.6139000058174133},{"id":"https://openalex.org/keywords/vulnerability-assessment","display_name":"Vulnerability assessment","score":0.5414000153541565},{"id":"https://openalex.org/keywords/vendor","display_name":"Vendor","score":0.5296000242233276},{"id":"https://openalex.org/keywords/good-practice","display_name":"Good practice","score":0.4203000068664551}],"concepts":[{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.8658000230789185},{"id":"https://openalex.org/C184356942","wikidata":"https://www.wikidata.org/wiki/Q830382","display_name":"Best practice","level":2,"score":0.8452000021934509},{"id":"https://openalex.org/C2778755073","wikidata":"https://www.wikidata.org/wiki/Q10858537","display_name":"Scale (ratio)","level":2,"score":0.6139000058174133},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.5414000153541565},{"id":"https://openalex.org/C2777338717","wikidata":"https://www.wikidata.org/wiki/Q1762621","display_name":"Vendor","level":2,"score":0.5296000242233276},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.49720001220703125},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4758000075817108},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.47450000047683716},{"id":"https://openalex.org/C3018028102","wikidata":"https://www.wikidata.org/wiki/Q254125","display_name":"Good practice","level":2,"score":0.4203000068664551},{"id":"https://openalex.org/C165609540","wikidata":"https://www.wikidata.org/wiki/Q1172486","display_name":"Data breach","level":2,"score":0.41499999165534973},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.4034999907016754},{"id":"https://openalex.org/C172776598","wikidata":"https://www.wikidata.org/wiki/Q7943570","display_name":"Vulnerability management","level":4,"score":0.3725999891757965},{"id":"https://openalex.org/C107101626","wikidata":"https://www.wikidata.org/wiki/Q842234","display_name":"Full disclosure","level":2,"score":0.33340001106262207},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.3287999927997589},{"id":"https://openalex.org/C39549134","wikidata":"https://www.wikidata.org/wiki/Q133080","display_name":"Public relations","level":1,"score":0.3021000027656555},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.29589998722076416},{"id":"https://openalex.org/C2778707766","wikidata":"https://www.wikidata.org/wiki/Q202064","display_name":"Phone","level":2,"score":0.259799987077713}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3777485","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3777485","pdf_url":null,"source":{"id":"https://openalex.org/S4210235901","display_name":"Digital Threats Research and Practice","issn_l":"2576-5337","issn":["2576-5337","2692-1626"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Digital Threats: Research and Practice","raw_type":"journal-article"},{"id":"pmh:oai:ris.utwente.nl:openaire_cris_publications/d4991730-94c8-43d7-b87b-cde69242ef28","is_oa":true,"landing_page_url":"https://research.utwente.nl/en/publications/d4991730-94c8-43d7-b87b-cde69242ef28","pdf_url":"https://ris.utwente.nl/ws/files/515486489/3777485.pdf","source":{"id":"https://openalex.org/S4406922991","display_name":"University of Twente Research Information","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Chen, T-H & Vos, J V D H 2026, 'Vulnerability Disclosure or Notification? Best Practices for Reaching Stakeholders at Scale', Digital Threats, vol. 7, no. 1, pp. 1-20. https://doi.org/10.1145/3777485","raw_type":"info:eu-repo/semantics/article"}],"best_oa_location":{"id":"doi:10.1145/3777485","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3777485","pdf_url":null,"source":{"id":"https://openalex.org/S4210235901","display_name":"Digital Threats Research and Practice","issn_l":"2576-5337","issn":["2576-5337","2692-1626"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Digital Threats: Research and Practice","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320321015","display_name":"University of Twente","ror":"https://ror.org/006hf6230"},{"id":"https://openalex.org/F4320321800","display_name":"Nederlandse Organisatie voor Wetenschappelijk Onderzoek","ror":"https://ror.org/04jsz6e67"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":23,"referenced_works":["https://openalex.org/W2112736324","https://openalex.org/W2489928578","https://openalex.org/W2762865122","https://openalex.org/W2767098552","https://openalex.org/W2785373701","https://openalex.org/W2794007494","https://openalex.org/W2892310063","https://openalex.org/W2959089217","https://openalex.org/W2969278689","https://openalex.org/W2999191767","https://openalex.org/W3007554785","https://openalex.org/W3084247208","https://openalex.org/W3183341016","https://openalex.org/W3213483581","https://openalex.org/W4212811276","https://openalex.org/W4296974094","https://openalex.org/W4297399555","https://openalex.org/W4323966588","https://openalex.org/W4384835150","https://openalex.org/W4386167594","https://openalex.org/W4392964054","https://openalex.org/W4401752802","https://openalex.org/W4402158735"],"related_works":[],"abstract_inverted_index":{"Vulnerability":[0],"disclosure":[1,65,115,149],"is":[2],"the":[3,26,44,56,173,177],"practice":[4,27,57],"of":[5,28,102,113,157],"a":[6,9,29,77,155],"finder":[7,30,78],"disclosing":[8],"newly":[10],"found":[11],"vulnerability":[12,59,75,103,193,196],"to":[13,20,89,105,116,125,191],"vendors.":[14,117],"It":[15],"has":[16,41],"received":[17,43],"best":[18,162,187],"practices":[19,188],"ensure":[21],"communication":[22],"between":[23],"stakeholders.":[24],"However,":[25],"or":[31,82,87,94],"vendor":[32],"notifying":[33],"end-users":[34,106],"about":[35],"vulnerable":[36],"systems":[37,93],"and":[38,47,70,100,137,145,150,167,179],"mitigation":[39],"plans":[40],"not":[42],"same":[45],"attention":[46],"guidelines":[48],"for":[49,131,189],"performing":[50],"it":[51],"at":[52,198],"scale.":[53,199],"We":[54],"identify":[55],"as":[58],"notification,":[60,76],"which":[61],"shares":[62],"similarities":[63],"with":[64,143],"but":[66],"presents":[67],"other":[68],"challenges":[69],"requires":[71],"different":[72,165],"approaches.":[73],"In":[74],"targets":[79],"known":[80],"vulnerabilities":[81],"misconfigurations":[83],"using":[84],"active":[85],"scans":[86],"datasets":[88],"determine":[90],"how":[91,158],"many":[92],"services":[95],"remain":[96],"vulnerable.":[97],"The":[98],"scale":[99],"complexity":[101],"notification":[104,151,197],"are":[107],"often":[108],"significantly":[109],"greater":[110],"than":[111],"those":[112],"multi-party":[114],"These":[118],"place":[119],"an":[120],"increasing":[121],"burden":[122],"on":[123,128,140,169,176],"finders":[124,190],"inform":[126],"stakeholders":[127],"time,":[129],"especially":[130],"academic":[132,146],"security":[133,182],"researchers,":[134],"ethical":[135],"hackers":[136],"practitioners.":[138],"Based":[139],"our":[141],"experience":[142],"notifications":[144],"publications":[147],"documenting":[148],"operations,":[152],"we":[153,184],"conduct":[154],"meta-review":[156,178],"researchers":[159],"have":[160],"adopted":[161],"practices,":[163],"pursued":[164],"strategies":[166],"reflected":[168],"their":[170],"operations":[171],"over":[172],"years.":[174],"Drawing":[175],"suggestions":[180],"from":[181],"communities,":[183],"propose":[185],"new":[186],"perform":[192],"disclosure,":[194],"particularly":[195]},"counts_by_year":[],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2025-11-20T00:00:00"}