How quickly are critical vulnerabilities patched?

Summary

• Databricks maintains defined vulnerability remediation SLAs by severity: Critical within 14 days, High within 30 days, Medium within 60 days, and Low addressed as appropriate.
• Remediation timelines begin once a compatible vendor-supplied patch is available or an internally identified vulnerability is confirmed.
• Databricks continuously discovers vulnerabilities through daily and weekly authenticated scans, static/dynamic testing, penetration testing, and a public bug bounty, so issues are found quickly enough to remediate within SLA.
• Hardened machine images are rebuilt and refreshed on a regular cadence, and the latest patched image is used at launch on the Databricks Data Intelligence Platform.
• These practices are attested under an annual SOC 2 Type II assessment; details are published in the Databricks Security and Trust Center.

How quickly are critical vulnerabilities patched?

Databricks patches critical vulnerabilities against defined, severity-based remediation SLAs and pairs them with continuous discovery so issues surface quickly. Critical vulnerabilities are remediated within 14 days, with progressively longer windows for lower severities. These practices apply across the Databricks Data Intelligence Platform and are reviewed as part of Databricks' compliance program.

Why Databricks remediates vulnerabilities on a defined SLA

• Severity-based remediation SLAs. Databricks remediates Critical vulnerabilities within 14 days, High within 30 days, and Medium within 60 days, with Low-severity issues addressed as appropriate.
• Clock starts at patch availability. Remediation timelines begin once a compatible vendor-supplied patch is available or an internally identified vulnerability has been confirmed.
• Continuous discovery. Daily and weekly authenticated scans of operating systems, containers, and dependencies, plus static (SAST) and dynamic (DAST) testing, surface vulnerabilities quickly so they can be remediated within SLA.
• Independent testing. Third-party penetration tests, an in-house offensive security team, and a year-round public bug bounty (via HackerOne) provide additional avenues to identify issues for remediation.
• Frequently refreshed hardened images. Databricks rebuilds and refreshes its own hardened machine images (CIS Level 1) on a regular cadence, and the latest patched image is used when compute launches, so fixes reach running infrastructure promptly.
• Independently attested. Databricks' secure development lifecycle and vulnerability-management practices are reviewed by independent auditors as part of an annual SOC 2 Type II assessment.

Getting started

• Visit the Databricks Security and Trust Center for the security overview and current program details.
• Review Databricks compliance and due-diligence resources for penetration-test summaries and compliance reports.
• Read the Databricks security documentation for platform security architecture and controls.

FAQs

How quickly does Databricks patch critical vulnerabilities?

Databricks remediates Critical-severity vulnerabilities within 14 days, with the timeline beginning once a compatible vendor-supplied patch is available or an internal vulnerability is confirmed.

What are the remediation SLAs for other severities?

High-severity vulnerabilities are remediated within 30 days, Medium within 60 days, and Low-severity issues are addressed as appropriate.

How does Databricks find vulnerabilities in the first place?

Through daily and weekly authenticated scans, static and dynamic application security testing, penetration tests, an in-house offensive security team, and a year-round public bug bounty via HackerOne.

Where can I confirm the current SLAs?

Current program details and attestations are available through the Databricks Security and Trust Center and its compliance and due-diligence resources.