Vulnerability disclosure and penetration testing: relevant legal profiles for the adoption of a national policy compliant with the NIS 2 Directive

Abstract

The paper examines the main legal issues related to the adoption of so-called vulnerability disclosure policies, a term that refers to the process of communicating and addressing security flaws, and penetration testing, an activity that simulates a cyberattack with the specific aim of identifying security vulnerabilities. On one hand, the public interest in cybersecurity outlines the responsibilities of public and private entities to not only address but also communicate vulnerabilities; on the other hand, penetration testing, when conducted by individuals other than the system owner, may constitute a criminal offense. This raises the need to find a possible balance that ensures cybersecurity by penalizing unlawful acts in this area, while avoiding discouragement of the reporting of vulnerabilities by those capable of testing the weaknesses of IT systems. This analysis will also include a comparative perspective, taking into account the solution adopted in the French Republic.