One of six vendors cannot meet the agreed multi-party disclosure date. Do you extend for everyone?

## What is actually being decided Six vendors ship a firmware component with the same flaw. A date was agreed. Five will make it; one says it needs another six weeks. The decision is not about fairness between vendors. It is a choice about which population of users stays exposed, and for how long. - **Extend:** all six vendors' users remain unpatched for six more weeks, during which the flaw could be independently rediscovered or leak from any of six organisations. The reporter, who agreed a window in good faith, is asked to wait again. - **Publish on time:** five vendors' users can act immediately. The sixth vendor's users learn they are exposed with no fix, though they may have a mitigation. Both options have victims. Anyone who presents this as obvious has not thought about it. ## Interrogate the reason before answering The reason for the slip determines the answer more than the length of the slip does. | Reason given | How to treat it | |---|---| | Signed firmware with a validation and qualification cycle | A physical constraint; a single short extension is reasonable if the plan is credible | | The fix broke a supported configuration, and re-work is under way | Genuine, but ask for evidence of progress and a hard date | | Coordination inside the vendor was slow, work started last week | Not a constraint; the other five should not fund it | | The vendor wants to align with its next quarterly release | A calendar preference, and the weakest reason on this list | And ask the question that decides it: **does the extra time change what the vendor's users can do?** If the vendor can ship a mitigation, a configuration change or a disable switch on the original date, the users are substantially protected and the case for holding everyone collapses. ## The middle options This is rarely a binary, and the options between are usually better than either pole: 1. **Publish on the date, with status per vendor.** The advisory states which vendors have shipped and which have a fix pending, with mitigations for the latter. Users of the late vendor get truth and an action rather than silence. 2. **Publish the flaw class without the exploitation detail.** Users can assess and mitigate; the fully weaponisable detail follows when the last fix ships. This is a genuine option, though it degrades quickly, since a public patch from five vendors is itself a map to the bug. 3. **One short extension, capped and announced.** A fixed number of days, communicated to every party and the reporter at once, with a commitment that there is no second one. 4. **Publish with the late vendor's own advisory prepared in parallel**, so its customers get a named workaround from their own supplier on day one. ## Precedent is the principal-level part A single decision here sets the behaviour of every future coordination you run. A coordinator who always extends teaches vendors that the date is a suggestion, and the effect compounds: the slowest participant sets the schedule for everyone, so the fast vendors begin to slow down too, since being ready early only means waiting. A coordinator with a published maximum window and a record of publishing on it protects the diligent majority from the slowest member, and, importantly, protects the reporter's willingness to coordinate at all next time. That is why the rule belongs in the coordination agreement at the start, not in a negotiation under pressure at week eight. Write down: the maximum total window, how many extensions may be granted and for how long, what reasons qualify, and who decides. Then the conversation with the late vendor is about applying a rule everyone signed, not about who shouts loudest. ## Who owns the call Not the most-affected vendor, and not the largest one. A neutral coordinator exists exactly so that a decision affecting competitors is not made by one of them. If there is no coordinator, the party that received the report is holding the pen, and it should behave like one: consult all parties, make the decision explicit and dated, and communicate it once to everybody. And remember who is not bound by any of it. The reporter can publish on the original date whatever the six vendors agree among themselves. An extension that has not been agreed with them is a plan, not a schedule, so bring them into the decision early and give them a reason that stands up. ## What to say publicly When you do publish with one fix outstanding, be plain about it. Naming a vendor as "fix pending" with a mitigation is not an attack; it is the information its users need to make a decision. Vagueness here, an advisory that implies everyone is covered, is the option that damages trust in the coordination process itself, because the first user who discovers their supplier had no fix learns that the advisory could not be relied on.