Likelihood of getting this answer: 10 percent. Vulnerability disclosure is a topic of much debate, and some vendors don’t see the value of preemptive customer disclosure. Others feel that no disclosure at all is the best policy, notifying their customers and the public only after a patch is ready. A large community of security “researchers” expose vendors publicly with no notice.

11. What technical guidance do you provide about vulnerabilities, including how they could be exploited, how they are currently being exploited, how to mitigate?

A good answer: For each vulnerability reported, we develop a threat profile that explains how and if the vulnerability can be exploited. We also identify mitigation strategies, if any, prior to developing and releasing a patch.

Likelihood of getting this answer: 25 percent. Software vendors that practice customer or public vulnerability disclosure are generally diligent about explaining mitigation strategies, if any exist.

12. Do you provide severity ratings for vulnerabilities, and how are they determined?

A good answer: Yes, we subscribe to the Common Vulnerability and Exposure standard developed by MITRE for categorization and we have developed our own software security severity rating system, which we publish publicly.

Likelihood of getting this answer: 25 percent. Companies such as Adobe and Microsoft have been good at defining and sharing their severity rating system. Users still need to be aware, however, that severity is a contextual measure, so judge for yourself how severe a vulnerability is in your environment.

13. Does your company monitor the latest attack trends in the underground community and consider how those trends may affect your software?

A good answer: Yes, we have a research team that searches for new attack trends and techniques. We try to stay in front of hackers by dedicating internal resources to malicious use of our applications and search the known communities where hackers communicate and share information.

Likelihood of getting this answer: 25 percent. Companies who take a proactive stance with security disclosure and severity ratings also generally conduct these types of activities.

14. Do you disclose all vulnerabilities that affect your software?

A good answer: We disclose all vulnerabilities we are aware of in our publicly released software.

Likelihood of getting this answer: 80 percent. But beware of the timing of the disclosure. Some companies only disclose after a patch is ready and posted on the same day as the disclosure, even though they knew about the vulnerability long before that.

15. What are the terms and period of your security support agreement?