Maryland Launches Vulnerability Disclosure Program to Bolster Cybersecurity

Maryland officials today launched a Vulnerability Disclosure Program (VDP) allowing cybersecurity researchers and residents to responsibly report potential security flaws in state websites and systems, aiming to proactively defend against growing cyber threats.

Administered by the Maryland Department of Information Technology (DoIT), the program applies to a broad network including executive branch offices, local governments, and organizations connected to networkMaryland, the state’s fiber-optic backbone. “Threat actors are constantly expanding their arsenal of tools and tactics to breach state and local systems — the State of Maryland must be proactive and aggressive in our response,” said DoIT Secretary Katie Savage in a statement. The VDP is a key component of the state’s broader effort to modernize its cybersecurity infrastructure, which has faced increasing challenges in recent years.

The program operates in partnership with Bugcrowd, a platform specializing in vulnerability disclosure and bug bounty programs. According to Acting Chief Information Security Officer James Saunders, this partnership leverages an established network of researchers and efficient triage workflows, “enhancing participation, increasing efficiency, and ensuring value for Maryland taxpayers.” DoIT’s Office of Security Management (OSM) will review reported vulnerabilities, prioritizing remediation in collaboration with affected agencies. A “Safe Harbor” provision protects good-faith researchers from prosecution, provided they adhere to program guidelines – a crucial element for encouraging participation. For more information on cybersecurity best practices, see the Cybersecurity and Infrastructure Security Agency website.

A binding operational directive issued October 21 requires all Maryland local governments and organizations using state-managed domains or networkMaryland services to participate in the VDP process. As of today, 23 reports have been submitted and validated since the program’s launch last week. Officials expect to publish anonymized data on vulnerability findings to ensure accountability and transparency.

DoIT officials stated they will continue to refine the program based on report volume and remediation timelines, with plans to expand vulnerability management to include bug bounties and “Hack the State” initiatives in the future.