DORA compliance.
Reports connected
to the right response.

Hackrate managed VDP can support external vulnerability intake, human validation, reporter communication, and a documented handoff to your security team. The resulting technical record can feed your vulnerability management and disclosure processes. Define the service contribution within your applicable DORA framework, with your organisation retaining risk, remediation, regulatory reporting, and compliance decisions.

DORA applies to covered financial entities, with categories, exclusions, and proportionality rules defined in the regulation. Banks, payment institutions, investment firms, and insurers are examples of the sectors addressed. ICT suppliers also need to understand relevant customer contracts and any obligations that apply to their own role. Supplying a financial entity does not automatically make a provider subject to every financial-entity requirement.

The technical rules address vulnerability management and responsible disclosure. A managed VDP is a service that can support part of that operating process. It should not be described as a universal requirement to purchase a public intake or bounty programme. Any invitation to actively test systems, researcher access, or reward commitment needs separate terms and authorisation.

Receiving a report and communicating vulnerability information to clients, counterparties, or the public are different activities. Article 10(2)(e) of Delegated Regulation (EU) 2024/1774 addresses the latter. Managed intake can provide useful evidence and coordination, but your organisation still needs procedures and owners for deciding and delivering appropriate external disclosure.

No. Your designated incident team must assess the facts against the applicable DORA classification and reporting requirements. A vulnerability report can contain information requiring urgent assessment, but an intake status or severity label does not determine the statutory outcome. Escalate relevant evidence promptly and keep the authority reporting process connected to the responsible internal team.

Managed disclosure receives and handles reports through an agreed channel. Your wider DORA programme must separately address the testing, scanning, and other requirements applicable to your organisation. A VDP is not a substitute for required automated assessments or threat-led penetration testing. Scope any active security testing as a separate engagement.

Agree the report format, access, retention needs, and included activities. Useful records can cover affected assets, technical evidence, validation limits, reporter discussion, ownership, decisions, remediation progress, and verification where included. Your organisation determines how those records fit its formal documentation and supervisory requirements.

The service supports a defined part of vulnerability handling. DORA also covers wider ICT risk management, incident management and reporting, resilience testing, and third-party risk. Your organisation remains responsible for those workstreams and the requirements of its applicable framework. The service does not constitute a DORA certification or a complete operational resilience assessment.

DORA is the sector-specific EU legal act for relevant financial entities under NIS2 Article 4. Its corresponding requirements take precedence in the areas addressed by that relationship. Determine your entity’s applicable framework and authority process before using either set of requirements. Other group entities or suppliers may require a separate assessment.