News
cybersecurity Magento StyleSmuggler zero-day exploited to deploy Linux backdoor - BleepingComputer cybersecurity BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations - BleepingComputer cybersecurity ⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More - The Hacker News cybersecurity Natural Resources Wales Data Breach Exposes Sensitive Employee Diversity Information - CyberPress threat-intel PoisonedRefresh Malware Backdoors F5 BIG-IP Servers With Memory-Only PHP Web Shells - GBHackers cybersecurity Mathspace discloses data breach affecting over 1 million people - BleepingComputer threat-intel Natural Resources Wales Data Breach Exposes Sensitive Employee Diversity Data - GBHackers cybersecurity Trezor data breach impact now reaches 81,000 customers - BleepingComputer cybersecurity Nightmare Eclipse Drops CrowdStrike, Nvidia, Avast Zero-Day Exploits - SecurityWeek cybersecurity North Korean Hackers Deploy New Linux Espionage Toolkit - SecurityWeek ai The Download: the hunt for underground hydrogen and more rogue OpenAI agents - MIT Technology Review cybersecurity ConnectWise Warns of ScreenConnect Guest File Transfer Flaw Affecting Cloud and On-Premise Systems - CyberPress threat-intel ConnectWise ScreenConnect Remote Access Flaw Impacts Guest File Transfer Sessions - GBHackers threat-intel Global Phishing Campaign Abuses Google Infrastructure to Evade Security and Steal Credentials - GBHackers cybersecurity Adobe Commerce Zero-Day Exploited to Backdoor Online Stores - SecurityWeek
1 / 15
All news ›

Responsible Disclosure Policy

Pro CISO® B.V. — Security Vulnerability Reporting

Report a vulnerability: security@prociso.com
We will acknowledge your report within 2 business days and keep you informed throughout.

Our Commitment

Pro CISO® B.V. takes the security of our systems and customer data seriously. We are ISO/IEC 27001:2022 certified and operate a formal Information Security Management System. Despite our best efforts, vulnerabilities may exist. We welcome responsible disclosure from the security community and commit to working with you transparently and in good faith.

Scope

This policy applies to vulnerabilities discovered in:

  • Our website: prociso.com and subdomains
  • The CA/CR® platform: cacr.prociso.com
  • Any other internet-facing systems operated by Pro CISO® B.V.

This policy does not cover vulnerabilities in third-party services or products we use but do not operate (e.g. Microsoft 365, cloud infrastructure providers).

What We Ask of You

  • Report the vulnerability to us promptly and in good faith at security@prociso.com
  • Give us reasonable time to investigate and remediate before public disclosure (we ask for a minimum of 90 days)
  • Do not access, modify, or delete data belonging to others
  • Do not perform denial-of-service attacks, social engineering, or physical security testing
  • Do not disclose the vulnerability to third parties before we have resolved it

What to Include in Your Report

  • A clear description of the vulnerability and the potential impact
  • The URL, system, or component affected
  • Step-by-step reproduction instructions
  • Any proof-of-concept code or screenshots (where relevant)
  • Your contact details so we can follow up

What We Commit to You

  • Acknowledge receipt of your report within 2 business days
  • Provide a preliminary assessment within 5 business days
  • Keep you informed of progress throughout remediation
  • Not pursue legal action against researchers who act in good faith and within this policy
  • Credit you publicly for the discovery (if you wish)

Out of Scope

The following are explicitly out of scope and should not be tested:

  • Denial-of-service or volumetric attacks of any kind
  • Automated scanning without prior permission
  • Physical security testing
  • Social engineering of Pro CISO® staff or customers
  • Vulnerabilities requiring physical access to a user's device
  • Self-XSS or issues only exploitable by an authenticated admin

Contact

Send all vulnerability reports to:

Pro CISO® B.V. - Security Team
security@prociso.com

For encrypted communication, please request our PGP key in your initial email and we will provide it promptly.