01 · The challenge
A mountain of reports
All internet-accessible systems were in scope, risking a flood of low-quality reports that would drain limited security resources.
Case Study
How a National Healthcare Organization Remediated 1,300+ Vulnerabilities Before Launching Its VDP
A national healthcare organization needed to launch a vulnerability disclosure program without overwhelming its security team. Synack’s vetted researchers tested more than 2,000 domains, enabling the organization to remediate over 1,300 vulnerabilities before launch. Expert triage, remediation guidance, and patch verification then helped the team act confidently on incoming reports.
2,000+ Domains tested before the VDP launch
1,300+ Vulnerabilities remediated before launch
< 18 days Median remediation time for VDP reports
A VDP without the noise
A vulnerability disclosure program invites outside reports, and most of them are invalid. The organization needed the signal without the noise.
02 · The approach
Test first, then launch
The Synack Red Team hunted for vulnerabilities across 2,000+ domains before the public was invited to participate.
03 · The outcome
Only valid, actionable reports
More than 1,300 vulnerabilities fixed before launch, and every incoming report certified for reproducibility.
Why healthcare needs a vulnerability disclosure program
In the first half of 2023, the U.S. healthcare sector experienced 295 breaches affecting more than 39 million people. Personal health information and the organizations that store it are a highly desirable target for malicious actors.
The Federal Trade Commission recommends establishing a VDP, and HIPAA requires healthcare providers to make a reasonable effort to prevent breaches, with fines as high as $1.5 million. A VDP can be part of that good faith effort.
But VDP reports vary in quality, the majority are invalid, and every one uses limited cybersecurity resources. With all internet-accessible systems in scope, the organization needed a way to set up and continuously manage its new program, so it turned to Synack.
High signal, low noise
The organization selected the Synack Platform to run high-quality vulnerability hunting before inviting the public to participate in its VDP.
Vetted Synack Red Team
The SRT provides a high signal-to-noise ratio, testing more than 2,000 individual domains in preparation for the responsible disclosure program. 95%+: acceptance rate of Synack reports across the public sector.
In-house triage
Synack removes false positives and reviews every submission for validity, reproducibility and impact before it reaches the organization.
Reports built for prioritization
Each report includes a description, location, steps to reproduce, remediation recommendations and CVSS metrics.
Patch verification
The Synack team verifies patches to confirm that remediation efforts were successful.
What the organization achieved
1,300+ vulnerabilities fixed before launch
Valid reports from the SRT let the team remediate more than 1,300 vulnerabilities before its VDP ever launched.
One process for every report
Whether a finding comes from an SRT member or an at-large researcher, Synack certifies it and submits only valid reports.
Fast remediation
Vulnerabilities reported through the VDP page have a median remediation time of less than 18 days.
Consistent data on every finding
Severity, location and exploit details are in the platform for every reported vulnerability.
A model for healthcare
The organization’s rigorous pre-launch testing provides a model for other healthcare organizations adopting managed VDPs.
Questions about the healthcare VDP case study
What is a vulnerability disclosure program?
A VDP gives the cybersecurity research community and the public guidelines for good faith vulnerability discovery on public-facing websites and services, and a way to report what they find.
Why did the organization test before launching its VDP?
All internet-accessible systems were in scope. Testing 2,000+ domains with the Synack Red Team first let the team fix more than 1,300 vulnerabilities before the public could report them.
How does Synack handle invalid VDP reports?
Synack triages every submission in-house, removes false positives and certifies each vulnerability for reproducibility, so only valid reports reach the organization.
How quickly are VDP findings remediated?
Vulnerabilities reported through the VDP page have a median remediation time of less than 18 days.
Does a VDP help with HIPAA?
HIPAA requires healthcare providers to make a reasonable effort to prevent breaches. A VDP can be part of an organization’s good faith effort to protect personal health information.
Get the National Healthcare Organization case study
Read how a national healthcare organization tested 2,000+ domains and fixed 1,300+ vulnerabilities before launching its VDP.
Case Study · IT services and training How FDM Group Turned Pentest Findings Into Fixes Read the FDM Group story → 
Case Study · Travel technology How Sabre Builds Human-Led API Security Testing into Its Development Cycle Read the Sabre story → 
Case Study · Oil and gas How NOV Found Exploitable Vulnerabilities It Could Act On Read the NOV story →