IBM PSIRT is the centralized process through which IBM customers, security researchers, industry groups, government organizations, or vendors report potential IBM security vulnerabilities. IBM is committed to monitoring reports of new threats and risks. IBM's Secure Engineering practices were designed to help IBM act in a timely fashion regarding a reported security vulnerability that affects an IBM product or solution. To help protect our customers, IBM does not publicly disclose or confirm security vulnerabilities until IBM has conducted an analysis of the product and issued fixes and/or mitigations.

A global team manages the receipt, investigation and internal coordination of security vulnerability information related to all IBM products and websites. This team then coordinates with each individual IBM product and solution team across the world to investigate, and if needed, identify the appropriate response plan. Maintaining communication between all involved parties, both internal and external, is a key component of IBM's vulnerability response process.

The IBM PSIRT process is IBM's own risk-based program, which is influenced by the FIRST framework and follows its four steps: Discovery, Triage, Remediation, Disclosure.