20 May 2026 5 min read Security
An exploited vulnerability is the highest-pressure case — a calm, evidenced response protects users and compliance.
Immediate steps
- Confirm and scope the exploitation.
- Mitigate or work around while a fix is built.
- Prepare an update and an advisory.
- Assess reporting obligations.
Evidence as you go
Capture the timeline; you will likely need to report and to show diligence afterwards.
Communicate
Tell affected users what to do — clear guidance reduces harm and builds trust.
This is an educational explainer. For the canonical regulation reference, see the dedicated Security page — or run an assessment to see how it applies to your product.