The Defect Registry

In 1966, Congress required automakers to report known safety defects to the federal government. By 1970, that authority sat with a new agency: NHTSA.

Manufacturers must notify NHTSA within five business days of discovering a safety defect. The reports are public; enter a VIN and you'll see every open recall tied to that specific vehicle.

For software, there's no universal requirement to disclose a known security defect, and no public registry where anyone can look up a product's security defect history.

Discussion prompts

• If your organization had to publicly disclose every known security defect within five business days, what would change?
• If a customer wanted to check your product's security defect history before buying it, what would they actually find?
• If CVE participation were mandatory tomorrow, what would your organization have to change first?