Trust "One-Pagers" - New Release - Vulnerability Management at Atlassian - Executive Overview

[#1]

We've published the second in our Trust one‑pager series — a concise, exec-ready overview of how Atlassian finds, prioritises, and fixes security vulnerabilities across 29,000+ repositories and every layer of our cloud infrastructure.

If you missed the first one, check out our New "Data Residency at Atlassian" one‑pager for your Security and Compliance.

What it covers:

• Multi-layer scanning (SAST, SCA, DAST, cloud posture, bug bounty)

• Our 4-step process: Detect → Assess → Remediate → Verify

• Published SLA tiers (Critical: 10 days → Low: 175 days)

• Independent validation (SOC 2 Type II, ISO 27001, third-party pen tests)

• How to report a vulnerability

When it's useful:

• Security/compliance reviews and vendor assessments

• CISO or board pre-reads

• Procurement & due-diligence packs

• Customer calls where vuln management is a top concern

📄 Download the One-Pager

Feedback welcome — what should wave 3 cover?

— Jo, Trust Engagement

[Frank Hess]

Hi @Joanna Milewska ,
can you check the permissions? DR is working but Security Vulnerabilities isn't allowed?
thanks
Frank

[Richard Scholtes]

The target of your link says, that I'm not allowed to view the content, although I was asked to file a permission request - which I did.

A good third one pager would be about Continuity Management / Desaster Recovery

[Joanna Milewska]

Thanks for pointing out - available now!

[Joanna Milewska]

We would love some feedback on the series @Frank Hess  and @Richard Scholtes  - Thank you - much appreciated!

[Richard Scholtes]

I really appreciate the series. Atlassian should give out more material for deciders, especially C-Level - not only for Trust Center.

[Yelyzaveta_Vasylenko_SaaSJet_]

Thank you for sharing this. These documents are especially useful in procurement conversations.

For wave 3, it would help to explain how Marketplace apps fit into the trust story. Atlassian’s trust documentation covers Atlassian itself, but apps installed on a customer’s site are a separate concern.