Dutch Institute for Vulnerability Disclosure

Profile narrative

The Dutch Institute for Vulnerability Disclosure (DIVD) is a non-profit foundation dedicated to coordinated vulnerability disclosure with the mission of improving internet security by facilitating responsible reporting and remediation of security flaws. It operates a structured platform where security researchers can submit vulnerability reports, which DIVD then validates, analyzes, and coordinates with affected vendors, operators, and relevant authorities to ensure timely patching. The organization’s scope encompasses a broad range of internet-connected systems, including critical infrastructure, government digital services, commercial software, and internet-of-things devices. Its services are offered globally, serving the international cybersecurity community by reducing systemic risk through transparent and methodical disclosure processes. The institute also publishes detailed advisories and case studies to share lessons learned from major coordination efforts.

DIVD functions as a volunteer-driven organization supported by a core team of experienced security researchers and a wider network of contributors specializing in areas such as network scanning, malware analysis, and industrial control systems. While the foundation does not publish exact headcount figures, it has coordinated disclosures affecting millions of systems worldwide, notably the Citrix ADC vulnerability in 2020 and the Microsoft Exchange Server vulnerabilities in 2021. Its advisories have reached organizations across multiple sectors, demonstrating a global footprint despite its Dutch origins. The institute maintains a close operational relationship with the Dutch National Cyber Security Centre (NCSC-NL) and participates in international coordination forums such as the Forum of Incident Response and Security Teams (FIRST). This collaborative model enables DIVD to handle complex, multi-party vulnerability cases at scale.

A key distinguishing attribute is DIVD’s specialization in proactive, large-scale internet-wide scanning to identify vulnerable configurations before they are actively exploited, complementing traditional reactive disclosure channels. Unlike commercial penetration testing firms, the foundation operates as a neutral intermediary with no commercial interest in the vulnerabilities it reports, which enhances trust among stakeholders including vendors, governments, and the public. DIVD maintains a public transparency log of its disclosure activities and publishes statistical reports on vulnerability trends, reinforcing its commitment to openness. Its recognized competence in managing high-pressure, time-sensitive coordination across diverse technical and organizational boundaries has positioned it as an authoritative voice in the European vulnerability disclosure landscape.

DIVD is established under Dutch law as a foundation (stichting) governed by a supervisory board, with no parent company or subsidiary structure that could compromise its independence. Funding is derived from a mix of government grants, industry sponsorships, and individual donations, all of which are disclosed in publicly available annual reports to ensure financial transparency. The organization deliberately does not offer paid security consulting or penetration testing services, maintaining a strict separation between its coordination role and commercial activities. This structural independence underpins its credibility as an impartial actor in the vulnerability disclosure ecosystem.

Incidents

0 incidents linked to this organisation.