Disclosure Drill

Vendor weeks against agent minutes. The disclosure question is not whether to report, it is whether the timeline anyone planned around still exists. The drill exists because that question does not belong in the middle of an incident.

The clock is the adversary

Coordinated disclosure assumed a window: report, patch, deploy, before exploitation. The window was measured in weeks because the adversaries measured themselves in weeks. Agents do not. An attack loop that runs in minutes does not respect a patch calendar.

The drill puts the clock in the room. Teams practice the disclosure decision against a simulation that moves at the tempo the threat actually moves, not the tempo policies were written for. The first time a team feels that tempo should not be during a live incident.

What the drill rehearses

Three decisions, in order. What is affected, stated precisely. Who must know, ranked by blast radius. What is published, and when, knowing the adversary operates on a faster clock than the review board.

None of the three decisions has a comfortable answer. That is the point. The drill exists so the discomfort is spent in practice, where a wrong call is a learning, instead of in production, where it is a disclosure.

The tempo test

Every disclosure policy has an unstated assumption about time. The drill surfaces it. Teams write their timeline, then watch the simulated incident resolve in minutes. The gap between the two is the finding.

Policies built for slower wars survive contact with this drill only if they were designed for it. The teams that pass the drill did not get faster. They made the decisions ahead of time, and the drill proved it.