@ajn142 @ifin I think that's broadly reasonable, but your comment was about a specific instance where we have some contraindicating facts.

In my view here's what was unhelpful: RUMINT about one, two, or more 0-days.

What was helpful: the (rescinded) NCSC-NL advisory with actual intelligence, and the community-shared reports of exploitation, along with indicators. To your point, it was these reports that created the pressure on the vendor to move quickly, as it should have. And again, this was information that met the criteria I lay out in the post. That's distinct from the unsubstantiated rumors at the beginning, which in my view had minimal effect on the vendor.