According to a survey conducted at the 2018 RSA Conference, 32% of respondents believe that researchers do not need to wait for a fix to disclose a vulnerability, while 25% think vulnerabilities should not be disclosed without a fix. Nearly half of respondents think vulnerabilities found by security researchers should be disclosed to the vendor first before public disclosure, but 36% think disclosure should only happen in partnership with security experts. Over half of respondents think proof-of-concept code should be disclosed along with vulnerability reports.

1. Tripwire RSA Conference 2018 Survey
Opinions on responsible security research practices

2. 60 days
32%
Does not need to
wait on a fix
25%
Should not be
disclosed without a
fix
20%
90 days
15%
120 days
6%
No answer
2%

3. Yes
49%No
50%
No answer
1%

4. Yes
48%
Yes, but in
partnership with
infosec experts
36%
No
14%
No answer
2%

5. Yes
36%
No
34%
Not sure
29%
No answer
1%

6. Yes
53%
No
26%
Not sure
20%
No answer
1%

7. Yes
24%
No
47%
Not sure
28%
No answer
1%

8. Survey conducted April 17-20, 2018 at RSA Conference 2018 in San Francisco, CA.
147 responses were collected.