When does it make sense, or is it common to not be given access to security audit resuts/reports when dealing with large companies who use your software?
How can a case be made for the benefits of sharing documentation on security gaps, and what are the risks of failing to disclose this information?
The company MediumSizedSoftwareCorp was recently approached by one of its customers, SuperGiantMegaCorp to conduct a security audit of MediumSizedSoftwareCorp's platform (which they use).
The audit was conducted in relative secrecy by a security and compliance team at SuperGiantMegaCorp and managers at MediumSizedSoftwareCorp were informed that their software platform had "failed" the audit. Managers are both companies are in a tizzy because the security issues threaten to derail future contract growth.
Engineers at MediumSizedSoftwareCorp desperately want to remedy the security issues, but SuperGiantMegaCorp will only discuss the vulnerabilities by phone, leaving out specifics and discussing only in vague, general terms. Compounding this is the fact that auditors at SuperGiantMegaCorp refuse to share detailed audit report documents because of the "sensitive" nature of the documents.
This scenario seems antithetical to closing gaps in security. Transparency and cooperation seem like better options, but how does one build an evidence-based case for this?