We found out about this policy of biannual disclosure of security updates a few years ago and we really like it. It helps us plan our IOS upgrades. However, it's unfortunate that it does not extend to all of Cisco's products. The "any given Wednesday" approach for all the rest of the Cisco products is a thorn in our patch management process - http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html#ds

Frequently we see vulnerabilities announced for IOS, and then a subset of the same vulnerabilities are announced for the ASA a month or so later. This seems to happen almost every time IOS vulnerabilities are announced. It's unfortunate because it gives hackers a period of time in which they can attack the ASA before the updated code is available.

What progress can be made to align these vulnerability disclosures between IOS and ASA, and to set schedules for the vulnerability/patch disclosures in other Cisco products?