Italy opens the door to ethical hackers to find security flaws

Italy's National Cybersecurity Agency (ACN) has adopted a national policy for the coordinated disclosure of vulnerabilities, known by the acronym CVD. The measure was signed by director general Andrea Quacivi on 7 October 2026 and stems from the legislative decree of 4 September 2024, through which Italy transposed the European NIS2 directive.

The policy creates a structured channel for reporting "zero day" vulnerabilities: security flaws that are not yet publicly known and for which a fix often does not yet exist. The goal is to have them identified and resolved before they can be exploited by attackers.

The mechanism involves three parties. Anyone who discovers a possible vulnerability, whether an individual or an organisation, can report it and ask that the report remain anonymous. CSIRT Italia receives the report, analyses it, and acts as technical liaison with the manufacturer or supplier of the system involved, coordinating assessment, mitigation and correction. The manufacturer or supplier, in turn, works with CSIRT Italia to find remedies and distribute an update, usually a patch, within agreed timeframes.

Reports can be submitted through an online platform on the ACN's website, at segnalazioni.acn.gov.it.

Legal limits

The agency notes that research activity must still comply with existing law and must not amount to a criminal offence. The measure therefore does not introduce a general "safe harbor", meaning a blanket guarantee of immunity for those who test systems without authorisation, nor does it announce a national system of financial rewards for finding flaws, as exists in some private bug bounty programmes.

The policy was adopted in agreement with the Ministry of Justice and after consulting the board for the implementation of the NIS regulation (Tavolo per l'attuazione della disciplina NIS). Director general Quacivi said the measure "consolida un modello di collaborazione tra istituzioni, ricercatori di sicurezza e operatori del settore" (consolidates a model of collaboration among institutions, security researchers and industry operators).

How effective the new channel proves to be will depend on factors still to be seen: how quickly reports are handled, the feedback given to those who report, how anonymity is managed in practice, and how willing suppliers are to cooperate.