Building a State Wide VDP - Lessons from Maryland's First Year in the Trenches

Steve Cain, Maryland's Director of Adversary Emulation, describes the state's first year building a vulnerability disclosure program after he was tasked with creating one in 2025. He argues that state and local public-facing systems are probed constantly, that a disclosure channel is far cheaper than a major incident response, and that a program gives good-faith researchers a structured way to report findings. He reviewed federal directives and other state programs, and recommends starting from an existing template such as disclose.io.

He then lays out three requirements he considers non-negotiable: a wide scope covering all state domains and connected networks, clear rules of engagement that allow proof-of-concept work without damage, and safe harbor that treats good-faith testing within those rules as authorized. Maryland's program launched in October 2025 and drew a strong early wave of reports, and it still averages roughly 40 to 50 actionable submissions a month. He also raised the rising volume of low-quality AI-generated reports, which he expects a future revision of the rules to address.

His takeaways are to reuse proven program material, get safe harbor right the first time, assume noble intent when a case is ambiguous, and use third-party triage and retesting to cut duplicates and verify fixes. He also plans to expand bug bounty events and formalize how disclosures are communicated to researchers.