When a vulnerability is discovered, what is the appropriate approach to communicating risk?

• A. Post only in internal chat
• B. Keep it secret
• C. Communicate risk to stakeholders
• D. Announce publicly before patching

Answer: (C)

When a vulnerability is found, the goal of communicating risk is to get the right people informed so they can act quickly and effectively. Sharing the risk with stakeholders—such as product owners, developers, IT and security teams, legal, and leadership—helps everyone understand the potential impact, the likelihood of exploitation, and what actions are needed. This enables proper triage, prioritization, and allocation of resources for mitigation, patching, or compensating controls, and supports a coordinated response plan.

Coordinated disclosure often follows a responsible approach: inform those who can fix the issue first, and only consider broader public communication once a fix or workaround is ready. Disclosing publicly before patching can invite attackers to exploit the vulnerability, while keeping details entirely secret or limited to internal chats delays remediation and increases risk. Communicating risk to stakeholders balances transparency with practicality, driving timely and effective risk reduction.