Esentire Vulnerability Disclosure

generated: '2026-08-12'
method: searched
source: https://trust.esentire.com/api/trustpage/public/v1/
name: eSentire security disclosure
description: eSentire publishes a named security contact but not a vulnerability disclosure policy. The
  contact is genuine and provider-published — security@esentire.com, attributed on eSentire's own trust
  page to the "Office of the CISO / Governance Risk and Compliance Team". That is the entire published
  surface. There is no disclosure policy page, no safe-harbour statement, no reporting SLA, no PGP key,
  no RFC 9116 security.txt on any eSentire host, and no bug bounty program on HackerOne, Bugcrowd or Intigriti.
  For an MDR vendor whose own research unit publishes security advisories about other people's software,
  the absence of an inbound disclosure policy is a notable asymmetry.
security_txt:
  present: false
  hosts_probed:
  - host: www.esentire.com
    path: /.well-known/security.txt
    status: 404
  - host: www.esentire.com
    path: /security.txt
    status: 404
  - host: api.esentire.com
    path: /.well-known/security.txt
    status: 403
  - host: atlas.esentire.com
    path: /.well-known/security.txt
    status: 200
    note: SPA HTML shell, not a security.txt. Rejected.
bug_bounty:
  present: false
  programs_probed:
  - url: https://hackerone.com/esentire
    status: 404
  - url: https://bugcrowd.com/esentire
    status: 404
incident_hotline:
  phone: 1-866-579-2200
  purpose: eSentire's 24/7 emergency line for organizations experiencing a breach. This is a customer/prospect
    incident-response intake, NOT a vulnerability-report channel for eSentire's own products. Recorded
    to keep the two from being conflated.
  published_at: https://www.esentire.com/
related_publications:
  security_advisories: https://www.esentire.com/resources/security-advisories
  note: Outbound advisories from eSentire's Threat Response Unit (TRU) about third-party vulnerabilities.
    Not a disclosure channel for reporting issues in eSentire.
gaps:
- No vulnerability disclosure policy is published anywhere on eSentire's public surface.
- No security.txt is served, so the contact is not machine-discoverable — a researcher has to render a
  JavaScript trust page to find it.
- No safe-harbour language, so a good-faith researcher has no published legal assurance.
- No bug bounty or coordinated-disclosure program.
x-evidence:
  fetched: '2026-08-12'
  urls:
  - url: https://trust.esentire.com/api/trustpage/public/v1/
    status: 200
    note: Contains contactEmail security@esentire.com, contactFullName "Office of the CISO".
  - url: https://www.esentire.com/.well-known/security.txt
    status: 404
  - url: https://www.esentire.com/responsible-disclosure
    status: 404
  - url: https://www.esentire.com/vulnerability-disclosure
    status: 404
  - url: https://hackerone.com/esentire
    status: 404
  - url: https://bugcrowd.com/esentire
    status: 404
x-contact:
  email: security@esentire.com
  attributed_to: Office of the CISO — Governance Risk and Compliance Team
  published_at: https://trust.esentire.com/
  verified: true
x-policy:
  published: false
  url: null
  safe_harbor: false
  sla: null
  pgp_key: null
contact: security@esentire.com
policy: null
evidence:
- url: https://trust.esentire.com/
  finding: security@esentire.com published by the Office of the CISO; no disclosure policy, bug bounty
    or security.txt found