Do They Get With the Program? Measuring Mitigation in a Solicited Vulnerability Notification Program

Attackers rapidly scan for newly-disclosed vulnerabilities across enterprise networks. In response, defenders have been running similar scans in order to notify the affected enterprise about their exposed attack surface as soon as possible. Such initiatives are becoming more institutionalized, e.g., under the EU's NIS2 directive and CISA's Ransomware Vulnerability Warning Pilot. Research on the effectiveness of vulnerability notifications has found disappointing results, where only a minor fraction of issues were fixed. This was blamed on problems in asset attribution, low trust in the sender, reachability issues, and lacking incentives of the recipient to act. A potential solution to all these problems would be a notification program where companies volunteer to sign up, register their assets, and ensure the right contact details. How much better could such a program perform? We provide the first empirical evaluation of a solicited notification program through a collaboration with a governmental Computer Security Incident Response Team (CSIRT) that offers security notifications to enterprises. We first conduct interviews with nearly half of all participating companies (n = 21) to understand why they signed up and how they act on the notifications. Next, we quantitatively study the remediation effectiveness of the program via survival analysis. We find that 27% of the security issues being resolved within one day of notification, 40% within one week, and 49% within one month. Over the entire three years of the program, the remediation rate is 75%. These findings already show higher remediation effectiveness compared to previous unsolicited experiments. This suggests that solicited notification programs can overcome challenges of reachability, trust, and motivation. We reflect on the limitations of these findings and their implications for the future.