UK PSTI / MANAGED VULNERABILITY DISCLOSURE
UK PSTI compliance.
Make disclosure
work in practice.
Support the vulnerability reporting part of your UK PSTI programme with a process your team can operate. Hackrate managed VDP connects a clear reporting channel, human validation, and reporter updates to the people responsible for your products.
A report arrives.
The right people act.
- 01External reporter
Product details and technical evidence
- 02Managed disclosure
Validation, clarification, and communication
- 03Your product team
Risk decisions, remediation, and release
UNDERSTAND THE PRODUCT SECURITY REGIME
What is UK PSTI?
A baseline for
connectable products.
The Product Security and Telecommunications Infrastructure Act 2022 and its 2023 security regulations establish the UK consumer connectable product security regime. It applies to relevant products supplied to UK consumers, with duties for manufacturers, importers, and distributors.
Vulnerability reporting is one part of the framework. Hackrate managed VDP can help put that reporting process into operation, while your organisation determines applicability and owns the wider compliance work. Start by identifying the products, supply-chain role, and obligations that apply to your business.
Framework and duties: OPSS consumer connectable product security guidance.
Product password security
Address the applicable password requirements, including restrictions on universal default and easily guessable passwords.
Security issue reporting
Publish how to report product security issues and the expected timescales for acknowledgement and status updates.
Security update information
Publish the applicable minimum security update period, including an end date, in clear and accessible information.
HACKRATE SERVICES
Give your product team
support where it counts.
Start with the gap in your current process. Connect external reports to technical expertise, an engineering owner, and a consistent conversation with the finder.
Managed vulnerability disclosure
Give customers and researchers a structured route to report product security issues. Hackrate supports agreed intake, validation, and reporter communication, with a clear handoff to your product owners.
Explore managed VDPHuman triage and validation
Separate the technical claim from the demonstrated impact. Within your managed programme, review relevance, reproduction information, duplicates, and missing context before routing a finding to engineering.
See the triage processScoped security testing
Complement incoming disclosures with an authorised assessment of agreed targets. Define the product interfaces, access, test environment, and technical limits so findings support a useful remediation plan.
Explore penetration testingEligible CVE support
Discuss a CVE identifier when a vulnerability qualifies and a public record is appropriate. Coordinate technical details and disclosure timing with the responsible parties through Hackrate’s CNA service.
Explore CNA and CVE supportReady to invite additional research? A managed bug bounty programme adds a defined testing scope and reward rules. Keep those permissions distinct from the policy for receiving unsolicited disclosures.
UK PSTI / REPORTING INFORMATION
Make the contact clear.
Make the response predictable.
The UK consumer connectable product security regime has applied since 29 April 2024. For in-scope manufacturers, its reporting-information requirement covers how people can report product security issues and what communication they can expect.
How to report
Publish the route for reporting security issues about the product. Make the information easy to locate and understand.
When receipt is confirmed
Publish the timescale within which the reporter can expect acknowledgement. Support that expectation with an agreed intake process.
How the conversation continues
Publish the timescales for status updates until the reported issue is resolved. Keep product owners involved so updates reflect progress.
The information must be available without prior request, in English, free of charge, and be accessible, clear, and transparent. See UK government guidance, security requirement 2 and Schedule 1 of the 2023 Regulations.
Publish timescales your process can support.
The reporting-information requirement does not prescribe a universal 24-hour acknowledgement deadline. Agree response coverage, internal handoffs, escalation, and backup ownership before publishing your commitments. A receipt confirmation is also different from a completed investigation or fix.
Assess the product and your supply-chain role.
PSTI concerns relevant consumer products that connect to the internet or a network, subject to statutory definitions and exceptions. Manufacturers, importers, and distributors have different duties. The wider regime also addresses password security, published minimum security update periods, statements of compliance, and action on compliance failures.
FROM FIRST CONTACT TO FOLLOW-THROUGH
One product report.
Six connected stages.
Shape the workflow around your products and team. Urgent escalation can run alongside validation, with product risk and incident decisions assigned to named internal owners.
Receive the report
Capture the affected product, model or version, reproduction information, evidence, and reporter contact where provided. Keep sensitive details in the agreed reporting channel.
Acknowledge and clarify
Confirm receipt using the agreed process. Request missing information and explain the next step. Keep communication consistent with the expectations published by the manufacturer.
Validate the finding
Review technical claims, duplicates, and demonstrated impact. Agree any reproduction access in advance, especially when hardware, firmware, customer environments, or suppliers are involved.
Route and assess
Send the finding to the responsible product team with evidence and open questions. Escalate signs of exploitation promptly while your organisation assesses incident and legal obligations.
Coordinate the response
Your engineers develop the fix or mitigation and assess affected versions. Keep decisions, progress, and reporter updates connected. Record verification outcomes where retesting is included.
Close and communicate
Agree the resolution message, customer advisory, and disclosure timing with the relevant owners. Consider eligible CVE coordination and feed lessons into product development and future testing.
BUILD A DISCOVERABLE PROCESS
Before the next report,
connect these four things.
The NCSC’s disclosure toolkit highlights communication, a clear policy, and security.txt. Use those foundations to make reporting discoverable, then agree how each submission reaches your product team.
Products and versions
Identify product families, supported versions, relevant interfaces, and engineering owners. Include supplier dependencies and safe reproduction constraints in the scoping discussion.
Policy and reporting route
Make contact information easy to find. Explain useful report details, secure communication, scope, and expected updates. Keep any security.txt contact and policy links current.
Decision and escalation paths
Name the people responsible for product impact, engineering work, customer communication, and urgent incidents. Define backup contacts and how sensitive evidence is shared.
Coverage and records
Agree included validation, communication coverage, reporting format, evidence access, retention needs, and any retesting. Keep acknowledgement, assessment, and resolution states distinct.
SUPPORT WITH DEFINED RESPONSIBILITIES
A useful extension
of your product team.
Agree who does the work and who makes the decisions. Managed disclosure supports the reporting part of your PSTI programme; the service scope should match your actual operational needs.
Hackrate’s agreed role
- Receive reports through the agreed disclosure channel.
- Review technical evidence and request clarification within the service scope.
- Coordinate reporter communication and the technical handoff.
- Support agreed verification and eligible CVE coordination.
Your organisation’s ownership
- Determine product scope, legal obligations, and published commitments.
- Make risk decisions and implement product fixes or mitigations.
- Manage security update periods, releases, and customer advisories.
- Handle compliance documentation and required authority notifications.
A managed disclosure engagement does not by itself provide complete PSTI compliance, an authorised representative, or a round-the-clock incident response team. Define additional needs explicitly and connect the service to your existing response arrangements.
YOUR QUESTIONS, ANSWERED
UK PSTI compliance
and managed VDP FAQs.
Understand product scope, reporting expectations, and how managed VDP supports the work.
Discuss your product scopeWhat is the UK PSTI product security regime?
The UK regime combines Part 1 of the Product Security and Telecommunications Infrastructure Act 2022 with the 2023 security regulations. It has applied since 29 April 2024 and concerns relevant consumer connectable products. Manufacturers, importers, and distributors have duties, with statutory definitions and product exceptions that must be assessed for each business.
How does managed VDP support UK PSTI compliance work?
Managed VDP can support the process behind your published reporting information: external intake, technical validation, reporter communication, and a documented handoff to product owners. Agree the products, included activities, response coverage, and escalation contacts. Your organisation retains responsibility for its published commitments, product decisions, and the other applicable PSTI duties.
What does UK PSTI require for vulnerability reporting?
The manufacturer must publish information about how to report product security issues and the timescales in which reporters can expect acknowledgement and status updates until resolution. The information must be accessible, clear, transparent, in English, free of charge, and available without prior request. Check the current legislation and guidance for the requirements that apply to your products.
Does PSTI set a universal 24-hour acknowledgement deadline?
The reporting-information requirement calls for published acknowledgement and status-update timescales. It does not set a universal 24-hour acknowledgement deadline. Agree a process and service coverage that can support the timescales your organisation publishes. Incident notification duties under other laws need a separate assessment.
Does a managed VDP make our products PSTI compliant?
A managed VDP can support the reporting process. It does not establish full PSTI compliance. Your organisation must assess product scope and its role in the supply chain, address the other applicable security requirements, and meet duties such as the statement of compliance and action on compliance failures.
Does every website or SaaS service fall under UK PSTI?
A website or standalone SaaS service is not automatically covered simply because it is accessible in the UK. The product security regime concerns relevant consumer connectable products, with statutory definitions and exceptions. Assess the product and the role of any associated service. A useful disclosure process can still be established for software and services outside that regime.
Do we need a public bug bounty or a CVE for every report?
A disclosure channel does not require you to promise rewards or invite unrestricted testing. Any active testing must follow explicit authorisation and programme rules. A CVE is relevant only where the vulnerability is eligible and a public identifier is appropriate; it does not replace a fix, a reporter update, or a statutory notification.
Can one disclosure process support UK and EU product security work?
A shared reporting channel and technical record can support teams serving both markets. Assess UK PSTI and EU CRA applicability, responsibilities, and reporting duties separately. Agree which product owners receive findings and which internal teams make disclosure, customer communication, and authority notification decisions.
PRIMARY REFERENCES
Understand the rules.
Shape the process.
Reviewed 25 October 2026
- UK government: PSTI product security regime Commencement and the security requirements, including reporting information.
- OPSS: consumer connectable product security Scope, supply-chain duties, compliance, and enforcement guidance.
- 2023 Regulations, Schedule 1 The security requirements for relevant connectable products.
- NCSC: Vulnerability Disclosure Toolkit Practical guidance on communication, policy, and security.txt.
Assess legal applicability using the current official texts and guidance. The service workflow on this page describes how Hackrate can contribute within an agreed engagement.
MAKE THE NEXT REPORT ACTIONABLE
Your products.
A connected response.
Bring your product portfolio, published reporting information, and internal owners. Scope a managed disclosure process that supports your UK PSTI compliance work with clear communication and an actionable handoff.
Discuss Your PSTI Requirements
Hackrate
Our platform helps companies to identify software vulnerabilities in a cost-efficient way. It provides a secure and centralized view of ethical hacking projects for your company.
US Patent Applied for HackGATE #63/645,845
Products
From the Blog
-
Hackrate Ranked 1st in Hungary and 22nd Globally at Hack The Box’s Global Cyber Skills Benchmark 2026
May 29 • 13 min read
-
Press release: Hackrate becomes Hungary’s first CVE Numbering Authority
Jan 13 • 5 min read ★
-
Let 2026 be the year bug bounty becomes part of how you build and operate
Jan 05 • 4 min read
Numbering Authority