How Radware handles security vulnerabilities
As a leading provider of cybersecurity solutions, Radware recognizes the
critical importance of protecting user privacy and security across the
internet. We are committed to developing and maintaining secure products
and services that earn and uphold the trust our users place in us,
striving to deliver innovative solutions that are designed to meet their
needs while prioritizing their security and best interests.
This site provides information for security researchers, customers, and
security professionals who may need to report vulnerabilities or
understand Radware's disclosure practices.
Reporting security issues
If you believe you have discovered a vulnerability in a Radware product
or service, or need to report a security incident, please contact our
security and privacy team at
dpo@radware.com.
Radware’s vulnerability disclosure policy
Radware views vulnerability disclosure as a shared responsibility
between security researchers and technology providers. Effective
protection of users depends on timely, coordinated action by all parties
involved.
Accordingly, Radware follows a disclosure framework designed to balance
vendor remediation needs with the defensive community’s right to
be informed. When a vulnerability is identified, Radware promptly
notifies the affected vendor and works collaboratively to support
remediation. Technical details are disclosed to the broader security
community after a standard remediation window of up to 90 days, or
earlier if a fix or mitigation is made publicly available by the vendor.
In certain circumstances, this disclosure timeline may be adjusted, as
described below:
-
If the deadline is due to expire on a weekend or a public holiday, the
deadline will be moved to the next normal working day.
-
Before the 90-day deadline has expired, if a vendor lets us know that
a patch is scheduled for release on a specific day that will fall
within 14 days following the deadline, we will delay the public
disclosure until the availability of the patch.
-
Where Radware observes a previously unknown and unpatched
vulnerability that is being actively exploited in the wild (a
“zero-day”), a significantly accelerated response is
warranted. In such cases, Radware generally applies a disclosure
window of up to 7 days. Active exploitation materially increases the
risk to users, as each additional day without awareness or mitigation
may result in further compromise. While this timeframe may not allow
vendors to fully remediate the issue, it should be sufficient to
publish interim guidance, such as mitigation steps, configuration
changes, or risk-reduction measures. Accordingly, if no patch or
advisory is released within this period, Radware may support the
responsible release of vulnerability details to enable users to take
protective action. In these situations, Radware also expects vendors
to clearly communicate that there is credible evidence of active
exploitation, and Radware may publish its own notice through its
security advisories or security bulletin channels to ensure timely
awareness.
Radware reserves the right to bring deadlines forwards or backwards
based on extreme circumstances. Radware remains committed to treating
all vendors strictly equally. Radware expects to be held to the same
standard.
This policy follows industry best practices and is strongly in line with
Radware’s commitment to improve industry response times to
security bugs but also results in softer landings for bugs marginally
over deadline. Creating pressure towards more reasonably timed fixes
will result in smaller windows of opportunity for cyber criminals to
abuse vulnerabilities. Radware believes that coordinated vulnerability
disclosure policies will result in greater overall safety for users of
the Internet. Radware’s adoption of these practices demonstrates
its commitment to internet security and industry leadership