generated: '2026-08-19'
method: searched
source: https://www.cisco.com/.well-known/security.txt (HTTP 200, text/plain, PGP-signed)
has_program: true
program: Cisco Product Security Incident Response Team (PSIRT)
security_txt:
  url: https://www.cisco.com/.well-known/security.txt
  status: 200
  file: well-known/intersight-security.txt
  signed: true
  canonical: https://www.cisco.com/.well-known/security.txt
  expires: '2027-01-01T00:00:00.000Z'
contact: mailto:psirt@cisco.com
policy: https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html
encryption: https://cscrdr.cloudapps.cisco.com/cscrdr/security/center/files/Cisco_PSIRT_PGP_Public_Key.asc
advisories:
  machine_readable: true
  format: CSAF
  url: https://www.cisco.com/.well-known/csaf/provider-metadata.json
  note: Cisco publishes security advisories in CSAF, so vulnerability data for Intersight is consumable by a machine,
    not only by a reader.
bug_bounty:
  has_program: false
  note: No HackerOne, Bugcrowd or Intigriti program found for Cisco Intersight; PSIRT coordinated disclosure is
    the published route.
note: 'Served on the parent corporate domain www.cisco.com, not on intersight.com — intersight.com returns a real
  404 for /.well-known/security.txt. Recorded anyway because Cisco PSIRT is genuinely the disclosure channel for
  Intersight: the published policy covers Cisco products and services as a class, and there is no product-level
  alternative. Also referenced: the Cisco Compute Intersight Hardening Guide white paper.'