CISA’s VDP platform: Five years of collaborative defense

CISA’s five-year retrospective on its Vulnerability Disclosure Program Platform describes how the shared service, operated with Bugcrowd and EnDyna since 2021, expanded from 11 federal civilian agencies to more than 60 and strengthened federal vulnerability management through centralized report intake, triage, remediation tracking, and researcher communication. Through June 2026, the platform received nearly 45,000 submissions, validated more than 5,700 disclosures, and supported remediation of over 5,300 vulnerabilities, while filtering approximately 87% of inactionable reports before they reached agencies and resolving about 95% of validated findings. Nearly 10,000 researchers have contributed to the program, with cross-site scripting, sensitive data exposure, and server-side injection among the most common vulnerability categories. Bug bounty events have also identified 532 vulnerabilities and awarded $1.3 million across 15 events, providing agencies with an additional crowdsourced testing option. The platform was created in part to help agencies meet the requirements of Binding Operational Directive 20-01, and it now accounts for nearly 75% of federal vulnerability disclosure reports, while Bugcrowd’s FedRAMP Moderate authorization is intended to enable broader deployment of its security testing services across government.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.