AVAT follows a Coordinated Vulnerability Disclosure (CVD) process. Our goal is to capture, assess, and remediate reported vulnerabilities in a structured way, and to share information in a manner that protects operators and users while avoiding undue risk to plant operations.

Principles

 Our CVD process is built on the following principles: 

• Confidential handling of vulnerability reports

• Objective and timely review of incoming reports

• Risk-based assessment of each reported vulnerability

• Coordinated alignment on workarounds, fixes, and disclosure

• Consideration of availability, safety, maintenance windows, and installed-base environments

• Appropriate notification of affected customers and users where action is required

Typical handling process

1. Intake and registration
   The report is logged and checked for completeness and relevance.

2. Triage
   We determine whether there is a genuine security relevance, which products are affected, and how critical the report is.

3. Technical analysis
   Our responsible experts analyze the root cause, exploitability, impact, and the affected versions or configurations.

4. Assessment and decision
   AVAT determines which measures are required.

5. Coordinating disclosure
   The timing and scope of any disclosure are chosen so that diagnosis and countermeasures can, wherever possible, be in place before broad publication.

6. Communication and closure
   Where possible and permitted, reporters are kept informed of progress. Once measures have been implemented, the case is documented and tracked internally.

How to submit a report

To report a vulnerability, please use the contact channels listed on our reporting page.