CISA folds its own hard-won lessons into coordinated vulnerability disclosure guidance

CISA and four allied cyber authorities released guidance urging suppliers to implement coordinated vulnerability disclosure programs; the article also reviews a May 15, 2026 CISA incident in which a researcher found internal AWS GovCloud keys in a public repository and had to use multiple, inefficient reporting channels before CISA responded, highlighting gaps in disclosure channels, playbooks, and key-management practices and offering concrete remediation recommendations.