We spent this week mapping where the industry’s largest manufacturers publish product security advisories. Top 100 by market cap, plus the big conglomerate divisions. About 25 of 110 keep an actual advisory or bulletin listing. Roughly 30 post a coordinated disclosure policy and a reporting address, nothing else. More than 40 have no public product security presence we could find.
The strong end: BD’s bulletin index. J&J’s dedicated portal. ZOLL, Nihon Kohden with an archive back to 2017, Canon Medical, Mindray with advisories tabbed by year. The quiet end includes names as large as Smith & Nephew, Teleflex and Dentsply Sirona, where known CVEs sit in third party databases and nothing sits on the company site.
524B made a coordinated disclosure process table stakes for FDA submissions. Publishing advisories is the part nobody has forced yet. Customers, researchers and the EU reporting regimes are getting there.
Advisory publishing is the visible line between mature and immature programs. It costs a web page. Silence is a choice, and buyers are starting to read it that way.