Unified versus differentiated supervision in vulnerability disclosure platforms: an evolutionary game analysis

Highlights

• In this study, we develop an evolutionary game model to compare unified and differentiated supervision in vulnerability disclosure governance.
• Unified supervision generates persistent cyclical dynamics, whereas differentiated supervision leads to stable equilibrium convergence.
• Supervisory cost, capability, and reputational feedback jointly determine the stability of the evolutionary system.
• A supervision success-rate mechanism captures endogenous feedback between platform behavior and regulatory effectiveness.
• The model reveals how micro-level strategic adaptation produces emergent macro-level governance patterns in cyber systems.

1 Introduction

Vulnerability disclosure platforms have become important intermediaries in cybersecurity governance. By connecting organizations with external security researchers, these platforms expand the scope of vulnerability discovery and create structured channels for responsible reporting beyond organizational boundaries [1–3]. Public-sector programs have likewise demonstrated the practical value of this model in vulnerability governance [2]. At the same time, the increasing platformization of vulnerability reporting raises a broader question: how should such platforms be governed under heterogeneous participation conditions, disclosure risks, and institutional constraints?

Existing research suggests that vulnerability disclosure is not merely a technical reporting issue. Disclosure outcomes are influenced by disclosure timing, legal arrangements, communication procedures, and stakeholder coordination [4–7]. Evidence from open-source software ecosystems further shows that vulnerability disclosure management remains uneven in practice. Many repositories still lack security policies or private reporting channels, even though coordinated disclosure is widely recognized as desirable [8]. Platform security features are also underused because of limited awareness, complexity, and insufficient automation support [9]. Related evidence based on bug bounty reports and security advisories indicates that review workflows, Common Vulnerabilities and Exposures (CVE) assignment, and platform-level reporting mechanisms affect the efficiency of vulnerability handling [10]. These studies jointly suggest that vulnerability disclosure outcomes depend not only on researcher willingness but also on the governance capacity of platforms and organizations.

From a platform perspective, this governance challenge becomes even more complex. Bug bounty platforms are not passive channels for receiving reports; rather, they function as two-sided digital intermediaries that shape participation, coordination, and disclosure outcomes [11]. Existing studies show that platform design choices affect both the volume and quality of submissions. In particular, differences between public and private programs reveal a clear trade-off between openness and outcome quality, suggesting that governance effectiveness depends on how participation is structured rather than on participation volume alone [12]. Recent research also shows that bug bounty ecosystems are affected by fairness problems, policy ambiguity, responsiveness, and platform–researcher relations, all of which influence researcher behavior and platform legitimacy [13]. In addition, the platformization of cybersecurity has increased the coordination burden on the organizational side, including attracting qualified researchers, managing report flows, identifying internal asset owners, and negotiating disclosure schedules [14]. Recent studies have examined cybersecurity governance from the perspectives of cyber risk propagation and defense resource allocation. Existing research suggests that supervisory resources should be dynamically allocated according to changing risk conditions to improve governance efficiency in complex cyber-physical systems [15]. However, these studies mainly focus on cyber risk propagation and defense resource optimization while paying less attention to how supervisory resources can be dynamically adjusted according to platform participation and how such adjustments influence the strategic evolution of stakeholders in vulnerability disclosure platforms. Building on these insights, this study extends the discussion of cyber risk propagation and defense resource allocation to the governance of vulnerability disclosure platforms, providing a theoretical perspective for understanding the relationship between supervisory resource allocation and differentiated supervision.

This dynamic perspective is reinforced by research on security crowdsourcing, bug bounty participation, and platform-mediated vulnerability governance. Prior studies have shown that white-hat participation depends not only on the existence of rewards but also on governance arrangements that shape expected benefits, relational climate, and reporting experience [16]. More broadly, bug bounty programs can be understood as platform-mediated participation structures in which access, competition, openness, and recognition shape collective outcomes [17]. At the same time, disclosure governance is constrained by institutional procedures, legal safeguards, and communication capacity, suggesting that effective disclosure depends on management infrastructure and coordination mechanisms rather than on disclosure intent alone [5, 7, 8]. Recent work has also highlighted articulation work, fairness, and heterogeneous governance burdens within bug bounty ecosystems, suggesting that platform environments are structurally uneven and therefore unlikely to respond uniformly to a single supervisory arrangement [13, 14].

Evolutionary game theory provides an important theoretical basis for studying strategic adaptation and governance stability among boundedly rational players engaged in long-term interactions. Classical studies show that evolutionary games can describe the dynamic adaptation process of players in economic and governance systems. They also provide methodological support for long-term equilibrium and stability analysis [18, 19]. Based on this theoretical foundation, we treat the government and the vulnerability disclosure platform as boundedly rational players and analyze their strategic evolution and stability outcomes under different supervision mechanisms. In recent years, evolutionary game studies have further extended from traditional two-population or multi-population frameworks to complex systems with networked structures, feedback-driven mechanisms, and control-oriented settings. For example, semi-tensor product (STP)-based control of networked evolutionary games with multi-channel structure emphasizes the influence of information channels and control mechanisms on strategic evolution [20]. Research on environmental-feedback-driven asymmetric N-player trust games reveals the co-evolutionary relationship between strategic behavior and external environmental states [21]. Studies on decision feedback under delays in control channels further show that feedback delays and control processes can affect the stability and convergence process of networked evolutionary game systems [22]. These studies indicate that evolutionary game theory has become an important methodological tool for analyzing strategic adaptation, feedback mechanisms, and stability in complex governance systems. However, these cutting-edge evolutionary game studies mainly focus on general theoretical issues, including complex network structures, environmental feedback, control mechanisms, and delayed feedback, and have rarely been discussed in the specific context of vulnerability disclosure platform governance. Meanwhile, prior research on vulnerability disclosure and security crowdsourcing has examined vulnerability reporting, coordinated disclosure, platform governance, and incentive mechanisms, but the dynamic effect of government supervision on platform participation remains insufficiently explained. In particular, the evolutionary differences between unified supervision and differentiated supervision under different risk and reputational feedback conditions have not been systematically examined. Therefore, we further examine the strategic interaction and stability outcomes between the government and the platform under different supervision mechanisms.

Existing analytical studies have begun to explore governance mechanisms in security crowdsourcing and vulnerability disclosure settings. In particular, evolutionary game research has examined how credit supervision, reward–punishment arrangements, and collaborative disclosure mechanisms affect the interaction among governments, platforms, and security participants [23–25]. Although existing studies have made substantial contributions to vulnerability disclosure governance, security crowdsourcing incentive mechanisms, and evolutionary game modeling, most of them focus on a single supervisory mechanism or a specific governance scenario. Comparatively little attention has been paid to systematically comparing the evolutionary behavior and stability characteristics of systems operating under different supervisory mechanisms. In particular, although previous studies have examined platform strategic adaptation and supervisory mechanisms, the dynamic differences between alternative governance structures remain insufficiently explored. To address this gap, this study develops separate evolutionary game models for unified supervision and differentiated supervision, and systematically compares their equilibrium properties and dynamic convergence characteristics, thereby providing a clearer theoretical understanding of how different supervisory mechanisms influence vulnerability disclosure governance.

To address the above research gaps, this study makes three main theoretical contributions. First, it develops separate evolutionary game models for unified supervision and differentiated supervision, providing a unified modeling framework for comparing different supervisory mechanisms under distinct model structures. Second, it incorporates the supervision success-rate mechanism and the social reputational feedback mechanism into the proposed models and characterizes their effects on the strategic adaptation of participating agents through parameter design, thereby capturing the role of external feedback in the evolutionary process. Third, based on local stability analysis, it systematically compares the equilibrium properties and dynamic evolutionary characteristics of the two supervisory models, thereby revealing the differences in convergence behavior and the underlying evolutionary mechanisms associated with different supervisory structures.

This study makes three main contributions. First, it contributes to research on platform governance by showing how different supervisory regimes generate different collective dynamics and governance outcomes in vulnerability disclosure platforms. Second, it contributes to cybersecurity governance research by conceptualizing vulnerability disclosure platforms as interactive systems shaped by strategic adaptation, reputational effects, and institutional incentives rather than as neutral technical reporting channels. Third, it contributes to the study of evolutionary dynamics by explaining why differentiated supervision is more likely than unified supervision to generate convergence toward stable governance in heterogeneous platform environments.

Accordingly, we adopt an evolutionary game approach to analyze the long-term interactions between government supervisory authorities and vulnerability disclosure platforms. Unlike static analysis based on the assumption of full rationality, the evolutionary game approach emphasizes that boundedly rational agents continuously adjust their strategies according to payoff feedback. Through repeated interactions, the proportions of agents adopting different strategies evolve over time, leading to collective dynamics that shape the macro-level governance patterns under different supervisory mechanisms. This study pursues three objectives: to compare the dynamic effects of unified supervision and those of differentiated supervision in vulnerability disclosure platforms; to examine how supervision cost, reputational feedback, supervisory capability, and reward–punishment mechanisms affect the strategic evolution of the government and the platform; and to identify the conditions under which differentiated supervision is more likely to generate stable governance outcomes. In doing so, the study links platform governance to collective dynamics and offers an evolutionary perspective on regulatory adaptation in digital environments.

2 Materials and methods

The governance problem examined in this study involves repeated strategic adaptation by both the regulator and the platform rather than one-shot decision-making. In vulnerability disclosure platforms, governments adjust supervisory intensity in response to governance risks, while platforms adapt their participation strategies in response to regulatory pressure, reputational consequences, and institutional incentives. Because both parties update their behavior gradually under bounded rationality, an evolutionary game approach is appropriate for analyzing the long-run dynamics and stability of alternative supervisory arrangements.

This analytical perspective is especially suitable for the present study for three reasons. First, the governance of vulnerability disclosure platforms is characterized by information asymmetry, heterogeneous incentives, and iterative interaction rather than complete information and instantaneous optimization. Second, unified supervision and differentiated supervision are not merely static policy choices; they shape different patterns of strategic adjustment between governments and platforms over time. Third, the key question of this study concerns governance stability, that is, whether a supervisory regime is likely to generate convergence toward a stable governance outcome or cyclical instability under changing institutional conditions.

In this study, unified supervision refers to a regulatory arrangement in which supervisory resources and reward–punishment rules are applied in a relatively uniform manner across vulnerability disclosure platforms, without explicitly adjusting supervision according to platform participation, disclosure risk, or governance capacity. Differentiated supervision refers to a risk-based and behavior-sensitive regulatory arrangement in which supervisory attention, supervision success, and reward–punishment mechanisms are adjusted according to platform participation and disclosure risk.

2.1 Analytical framework and model assumptions

To operationalize this governance problem, we specify the strategic choices, costs, benefits, and reputational effects associated with alternative supervisory arrangements. The government chooses between strict supervision and lax supervision, while the platform chooses between active participation and negative participation in vulnerability disclosure governance. Based on these strategic choices, we construct the payoff structure of the two parties under unified supervision and differentiated supervision.

As environmental complexity and cognitive limitations prevent both parties from identifying the optimal strategy instantaneously, the government and the platform are treated as boundedly rational players. Their strategies evolve over time through repeated adjustment.

Assumption 1 Drawing on Zhao and Sun’s evolutionary game study on security crowdsourcing ecosystem governance, we select the government and the vulnerability disclosure platform as two boundedly rational game players. This setting is used to describe the dynamic interaction between governmental supervision requirements and platform participation behavior [23]. Based on Tian et al.’s evolutionary game research on platform data security governance, governmental supervision usually differs in supervisory intensity and can generally be divided into strict supervision and lax supervision [26]. Therefore, the government chooses strict supervision with probability x and lax supervision with probability 1 − x, where 0 ≤ x ≤ 1. The platform’s participation behavior is defined as active participation or negative participation according to its real-world responsibilities in vulnerability disclosure governance. These responsibilities mainly involve vulnerability report intake, triage, validation, communication, and remediation coordination. For example, in 2024, the Google Cloud Vulnerability Reward Program triaged more than 400 vulnerability reports and identified more than 200 unique security issues [27]. Accordingly, active participation refers to sufficient and timely engagement in these activities, whereas negative participation refers to insufficient input or delayed responses. The platform chooses active participation with probability y and negative participation with probability 1 − y, where 0 ≤ y ≤ 1. It should be noted that security researchers, affected organizations, users, open-source maintainers, and industry communities also participate in the vulnerability disclosure ecosystem. However, we focus on the core interaction between government supervision and platform participation. To maintain the analytical tractability of the model, these actors are not modeled as independent players. Instead, their influence is incorporated into parameters such as platform revenue, reputational return, social reputational loss, and punishment intensity. Therefore, the proposed two-player evolutionary game model is intended to capture the core strategic evolution between government supervision and platform participation. Its conclusions should be interpreted within the boundary of the proposed model rather than as a complete representation of interactions among all actors in the vulnerability disclosure ecosystem.

Assumption 2 When the government chooses strict supervision, it incurs a higher supervisory cost C 1, mainly including rule enforcement, compliance inspection, vulnerability report verification, risk assessment, response coordination, and disclosure supervision [28]. Under this strategy, the government guides platform participation through a reward S 1 and a punishment F 1. To establish vulnerability reward mechanisms, it also states that platforms that fail to handle, publish, or use vulnerability information as required may be handled or punished according to law [29]. If the platform chooses negative participation, procedural disorder may lead to illegal or improper disclosure with probability P 1, which causes economic loss L [30]. For example, in 2025, vulnerabilities in Microsoft SharePoint Server were exploited by attackers to deploy ransomware, and the related attacks affected at least 400 victims [31]. IBM’s Cost of a Data Breach Report 2025 also shows that the global average cost of a data breach was USD 4.44 million [32]. In line with the OECD’s “Survey on Drivers of Trust in Public Institutions: 2024 Results” and Boston Consulting Group’s “How Governments Can Strengthen Cybersecurity and Trust,” we assume that government reliability, responsiveness, and risk-handling capacity may influence public trust [33, 34]. If the platform chooses active participation, the government obtains reputational return R 1 from improved public trust in the process of vulnerability governance.

Assumption 3 According to Li et al., when the government chooses lax supervision, it incurs a lower supervision cost C 2, where C 2 < C 1 [35]. If the platform chooses negative participation, the probability of illegal or improper vulnerability disclosure increases to P 2, where P 2 > P 1. Based on Preecha’s study on the relationship between cybersecurity risks and trust in government digital governance, cybersecurity incidents and data breaches may weaken public trust in the government’s cybersecurity governance capacity [36]. Therefore, negative participation by the platform under lax supervision reduces the government’s reputational return R 1 in vulnerability governance.

Assumption 4 Based on the study by Finifter, Akhawe, and Wagner, vulnerability reward programs can help platforms discover and remediate security vulnerabilities [37]. Accordingly, E denotes the platform’s net revenue generated through vulnerability discovery, verification, and remediation. When the platform chooses active participation, it needs to invest resources in report triage, vulnerability validation, communication and feedback handling, remediation coordination, and program operation, thereby incurring a higher participation cost C 3 [38]. When the platform chooses negative participation, it incurs a lower cost C 4, where C 4 < C 3. In addition, active participation helps improve the platform’s reputational return R₂, whereas negative participation reduces it. For example, Google stated in its VRP 2025 Year in Review that its vulnerability reward programs made more than USD 17 million in bounty payments to more than 700 researchers worldwide in 2025. The continued expansion of these programs reflects sustained engagement from the external security research community and helps strengthen platform trust and reputational return [39]. It should be noted that, to maintain model solvability and parameter comparability, C 3 and C 4 are considered constant parameters. However, in reality, the marginal cost of platform participation in vulnerability disclosure governance may vary with platform scale, resource conditions, and infrastructure capacity.

Assumption 5 Under differentiated supervision, the government dynamically adjusts its supervisory attention according to the platform’s level of participation in vulnerability disclosure governance. Based on recent studies on cyber risk propagation, we assume that changes in risk conditions affect the effectiveness of supervisory resource allocation and overall governance effectiveness [40]. Consistent with this perspective, the government dynamically allocates supervisory resources according to the platform’s participation behavior, thereby capturing the adaptive nature of differentiated supervision. Since this study focuses on designing a differentiated supervision mechanism by identifying the platform’s strategic choice in vulnerability disclosure governance, a simplified functional form is adopted for subsequent modeling and analysis. Drawing on the evolutionary game study of Li, Xu, and Huang, which shows that the probability of strict government supervision decreases as the probability of active platform response increases, we set the supervision success rate as g y = Q 1 − y [41]. This specification captures the decreasing effectiveness of supervision as platform participation intensity increases, reflecting the endogenous interaction between regulatory success and system behavior. Here, Q denotes the highest possible level at which the government can successfully identify and constrain the platform’s negative participation, given the existing regulatory technology, staff capability, and information acquisition capacity. Under differentiated supervision, platform participation behavior serves as the primary basis for allocating supervisory resources. A lower level of platform participation corresponds to a higher supervision success rate, whereas a higher level of platform participation corresponds to a lower supervision success rate. Accordingly, the supervision success-rate function captures how supervisory effectiveness is dynamically adjusted according to the platform participation behavior.

Assumption 6 Under differentiated supervision, the government adopts strict supervision and strengthens the government reward–punishment mechanism. According to the platform’s participation in vulnerability disclosure governance, differentiated supervision introduces an additional social reputational return S 2 and an additional social reputational loss F 2 on the basis of the government reward S 1 and punishment F 1. Here, social forces mainly refer to external supervisory forces that can affect platform trust, reputation, and willingness to cooperate, including security researchers, affected users or customers, industry security communities, and external public evaluation. Drawing on the study by Zhao et al. on coordinated vulnerability disclosure, trust mechanisms, and reward–punishment mechanisms in security crowdsourcing, active participation in vulnerability disclosure governance can enhance external researchers’ trust and willingness to cooperate. Therefore, the platform obtains the additional social reputational return S 2 [24]. By contrast, based on the study by Syed et al. on the dissemination and exposure of vulnerability information on social media, external attention and public evaluation pressure can create practical constraints on the platform’s vulnerability response behavior. Therefore, negative participation by the platform leads to the additional social reputational loss F 2. Therefore, S 2 and F 2 in this study represent the reputational return and loss generated by external social forces, respectively, based on the platform participation behavior. These are used to describe the incentive and constraint effects of social feedback on platform governance behavior. It should be noted that this type of feedback may be influenced by media exposure, the scope of information dissemination, and public cognitive biases. Therefore, in the interpretation of the model, it should be understood as external social feedback rather than objective security improvement itself [42]. If the government chooses lax supervision, external supervisory forces cannot form a stable joint constraint with governmental supervision, making the joint incentive and constraint mechanism difficult to implement effectively. Social reputational feedback is triggered by platform participation behavior and influences strategic adjustment by affecting the platform’s expected payoff. As a complementary mechanism to formal supervision, it operates through social oversight and jointly shapes the platform’s strategic evolution together with participation-behavior-based differentiated supervision. This mechanism is introduced to capture the social consequences associated with the platform behavior. Table 1 summarizes the main parameters of the model.

2.2 Evolutionary stability analysis

Based on the payoff structures defined above, we derive the replicator dynamics of the government and the platform under unified supervision and differentiated supervision. We then construct the corresponding Jacobian matrices and evaluate the local stability of the equilibrium points by examining the determinant and trace conditions. This procedure allows us to compare whether the two supervisory regimes generate convergence toward stable governance outcomes or cyclical instability.

To clarify the strategy update mechanism used in the evolutionary game model, we adopt the continuous-time replicator dynamic rule, following Taylor and Jonker’s classical study on evolutionarily stable strategies and game dynamics [43]. This rule describes how the proportion of a strategy changes according to the payoff gap between the strategy’s expected payoff and the average payoff of the corresponding population. Specifically, a strategy with an expected payoff higher than the population average increases in proportion, whereas a strategy with an expected payoff lower than the population average decreases in proportion.

In this model, the government is the supervisory actor, and its strategy set includes strict supervision and lax supervision. The government’s strategy updating is reflected in the dynamic change in the probability x of strict supervision. When the expected payoff of strict supervision is higher than the average payoff of the government, x increases. When the expected payoff of strict supervision is lower than the average payoff, x decreases. The platform is the participating player in vulnerability disclosure governance, and its strategy set includes active participation and negative participation. The platform’s strategy updating is reflected in the dynamic change in the probability y of active participation. When the expected payoff of active participation is higher than the average payoff of the platform, y increases. When the expected payoff of active participation is lower than the average payoff, y decreases. Based on this strategy update rule, this study further derives the replicator dynamic equations of the government and the platform under unified supervision and differentiated supervision.

2.2.1 Unified supervision

Under unified supervision, supervisory resources are allocated uniformly across vulnerability disclosure activities on the platform. This mechanism emphasizes consistency, but it does not explicitly account for differences in disclosure risk, platform behavior, or supervision success rates. Based on the assumptions above, the payoff matrix under unified supervision is constructed in Table 2. The expected payoffs, average payoffs, and replicator dynamic equations of the government and the platform, as presented in Equations 1–3, respectively, are then derived to form System (I).

G 1 = y − C 1 − S 1 + R 1 + 1 − y − C 1 + F 1 + R 1 − P 1 L , (1)

G 2 = y − C 2 − R 1 + 1 − y − C 2 − R 1 − P 2 L , (2)

G ¯ = xG 1 + 1 − x G 2 . (3)

TABLE 1. Main parameters of the game model under alternative supervisory mechanisms.

TABLE 2. Payoff matrix of the government and the platform under unified supervision.

Let

G y = C 2 − C 1 + 2 R 1 − y S 1 + 1 − y F 1 − 1 − y P 1 − P 2 L , (4)

H 1 = x − C 3 + E + S 1 + R 2 + 1 − x − C 3 + R 2 − E , (5)

H 2 = x − C 4 − F 1 − R 2 + 1 − P 1 E + 1 − x − C 4 − R 2 + 1 − P 2 E , (6)

H ¯ = yH 1 + 1 − y H 2 . (7)

In Equations 4–7, E denotes the long-term ecosystem benefits obtained through the platform’s active participation in vulnerability disclosure governance, including enhanced platform reputation, increased user trust, and ecosystem-wide collaborative benefits. Although the payoff term associated with E may appear in different forms under different strategy combinations because of changes in the platform’s participation status and the corresponding payoff structure, its economic interpretation remains consistent throughout the model.

Consider Equation 8:

J x = C 4 − C 3 + 2 R 2 + P 2 E + x F 1 + S 1 + P 1 E − P 2 E . (8)

Based on the payoff matrix in Table 2, we first calculate the expected payoffs of the government under strict supervision and lax supervision, as shown in Equations 1 and 2. The average payoff of the government is then obtained, as shown in Equation 3. On this basis, the government replicator dynamic equation under unified supervision is derived, as shown in Equation 9. The platform equation follows the same derivation process. The expected payoffs of the platform under active participation and negative participation are first calculated according to Table 2, as shown in Equations 5 and 6. Then, by combining them with the average payoff of the platform, as shown in Equation 7, the platform replicator dynamic equation under unified supervision is obtained, as shown in Equation 10. To improve the transparency and reproducibility of the model derivation, the two replicator dynamic equations are explicitly labeled as follows.

The government replicator dynamic equation under unified supervision is shown in Equation 9:

F x = dx dt = x G 1 − G ¯ = x 1 − x C 2 − C 1 + 2 R 1 − y S 1 + 1 − y F 1 − 1 − y P 1 − P 2 L . (9)

The platform replicator dynamic equation under unified supervision is shown in Equation 10:

F x = dy dt = y H 1 − H ¯ = y 1 − y C 4 − C 3 + 2 R 2 + y S 1 + P 2 E + x F 1 + S 1 + P 1 E − P 2 E . (10)

Equations 9 and 10 together constitute the two-dimensional evolutionary dynamic system under unified supervision, namely, System (I). Equation 9 describes the dynamic adjustment process of the government’s strict supervision strategy, while Equation 10 describes the dynamic adjustment process of the platform’s active participation strategy. The subsequent equilibrium point analysis and Jacobian matrix analysis are both conducted based on System (I).

Let F x = F y = 0; there are five equilibrium points in the system (I):(0,0), (1,0), (0,1), (1,1), and (X 1 , Y 1. Among them, (X 1 , Y 1 can be calculated using Equation 11:

x 1 = C 4 − C 3 + 2 R 2 + P 2 E − F 1 − S 1 − P 1 E + P 2 E y 1 = C 2 − C 1 + 2 R 1 + F 1 − P 1 L + P 2 L F 1 + S 1 − P 1 L + P 2 L (11)

Based on the above replicator dynamic equations, the Jacobian matrix of System (I) is obtained by taking the first-order partial derivatives of the government and platform replicator equations with respect to x and y, respectively. Specifically, the matrix elements satisfy a 11 = ∂ F x ∂ x, a 12 = ∂ F x ∂ y, a 21 = ∂ F y ∂ x, and a 22 = ∂ F y ∂ y. Therefore, the Jacobian matrix J 1 of System (I) can be expressed as shown in Equation 12:where a 11 and a 22 can be calculated using Equation 13:

J 1 = ∂ F x ∂ x ∂ F x ∂ y ∂ F y ∂ x ∂ F y ∂ y = a 11 a 12 a 21 a 22 , (12)

J 1 a 11 = 1 − 2 x C 2 − C 1 + 2 R 1 − y S 1 + 1 − y F 1 − 1 − y P 2 − P 1 L a 12 = x 1 − x − S 1 − F 1 + P 1 − P 2 L a 21 = y 1 − y S 1 + F 1 + P 1 E − P 2 E a 22 = 1 − 2 y C 4 − C 3 + 2 R 2 + P 2 E + x F 1 + S 1 + P 1 E − P 2 E (13)

Table 3 reports the determinant and trace values of the equilibrium points in System (I).

TABLE 3. Stability analysis of System (I) under unified supervision.

Table 4 indicates that points (0,0), (1,0), (0,1), and (1,1) are saddle points in the system, indicating that they are unstable, whereas the point (X 1 , Y 1 is stable, and the related Jacobi matrix is as follows: θ 1 = 0 E 1 E 2 0, where E 1 and E 2 can be calculated using Equation 14:

E 1 = C 4 − C 3 + 2 R 2 + P 2 E S 1 + F 1 − P 1 L + P 2 L C 4 − C 3 + 2 R 2 + S 1 + F 1 + P 1 E F 1 + S 1 + P 1 E − P 2 E 2 E 2 = C 1 − C 2 − 2 R 1 + S 1 S 1 + F 1 + P 1 E − P 2 E C 2 − C 1 + 2 R 1 + F 1 − P 1 L + P 2 L F 1 + S 1 − P 1 L = P 2 L 2 (14)

TABLE 4. Summary of possible evolutionary outcomes of System (I) under different parameter conditions.

Thus, Tr θ 1 = 0 and Det θ 1 = − E 1 E 2 > 0. The corresponding characteristic roots are as follows: λ 1 λ 2 = ± i Det θ 1 = ± i E 1 E 2.

Therefore, the stability classification of equilibrium points in System (I) is summarized in Table 4 based on the sign conditions of the Jacobian determinant and trace. Based on the stability classification in Table 4, the dynamic outcomes of System (I) are further analyzed in Proposition 1.

Proposition 1 The above analysis indicates that, under the unified supervision regime, the internal equilibrium point x 1 , y 1 exhibits a pair of purely imaginary eigenvalues of the Jacobian matrix, and the local trajectories form closed orbits around this point. Therefore, the “Stable” result reported in Table 4 should be further interpreted, in terms of dynamical systems theory, as a center, corresponding to a neutrally stable equilibrium. This implies that the system exhibits periodic evolutionary behavior in the neighborhood of the internal equilibrium point, where trajectories remain confined within its vicinity over time but do not converge asymptotically to the equilibrium. The possible evolutionary stable strategies are as follows: When − C 1 + R 1 + F 1 − P 1 L < − C 2 − R 1 − P 2 L and − C 3 + R 2 < − C 4 − R 2 − P 2 E, 0 , 0 is the evolutionary stable point of the system. When − C 1 + R 1 + F 1 − P 1 L > − C 2 − R 1 − P 2 L, 1 , 0 is the evolutionary stable point of the system. When − C 1 + R 1 − S 1 < − C 2 − R 1 and − C 3 + R 2 > − C 4 − R 2 − P 2 E, 0 , 1 is the evolutionary stable point of the system. When − C 1 + R 1 − S 1 > − C 2 − R 1, 1 , 1 is the evolutionary stable point of the system.

When the relevant parameter conditions in Proposition 1(1) hold, the government evolves toward lax supervision, while the platform evolves toward negative participation. This outcome indicates that when strict supervision is not sufficiently attractive and platform participation does not yield adequate returns, both parties choose low-effort strategies, resulting in weak governance.

When the conditions in Proposition 1(2) hold, the government evolves toward strict supervision, while the platform evolves toward negative participation. This suggests that even though the government is willing to maintain stronger supervision, the platform still lacks sufficient incentives to participate actively. In this case, governance relies mainly on external pressure rather than cooperative participation.

When the conditions in Proposition 1(3) hold, the government evolves toward strict supervision, and the platform evolves toward active participation. This outcome represents the most desirable governance pattern under unified supervision because strict supervision and active participation reinforce each other and jointly improve the governance of white-hat vulnerability disclosure.

When the conditions in Proposition 1(4) hold, the government evolves toward lax supervision, whereas the platform evolves toward active participation. This implies that the platform can maintain active participation even when the government reduces supervisory intensity. In such a case, platform-side incentives and reputational returns are sufficiently strong to sustain participation without continuous high-intensity intervention.

2.2.2 The case of differentiated supervision

Under differentiated supervision, supervisory intensity is adjusted according to platform participation behavior, governance conditions, and disclosure risk. The differentiated supervision considered in this study refers to a supervisory arrangement in which the government dynamically allocates supervisory resources according to the platform participation behavior. In vulnerability disclosure governance, supervisory resources are generally prioritized for platforms with insufficient participation or higher governance risk, thereby improving supervisory efficiency and promoting sustained and standardized participation. In the proposed model, platform participation behavior serves as the basis for implementing differentiated supervision, and the supervision success-rate function g y describes how supervisory effectiveness is dynamically adjusted according to the level of platform participation. Therefore, the differentiated supervision discussed in this study should be interpreted as participation-behavior-based differentiated supervision. It does not explicitly incorporate other risk-related factors, such as vulnerability severity, platform size, governance capacity, or historical compliance records. Compared with unified supervision, this mechanism combines dynamic supervision with a strengthened reward–punishment structure. Based on the payoff matrix in Table 5, the expected payoffs and average payoffs of the government and the platform are obtained, and the corresponding replicator dynamic equations are presented in Equations 15–17 as System (II):

G 3 = y − C 1 − g y S 1 + R 1 + 1 − y − C 1 + g y F 1 + R 1 − P 1 L , (15)

G 4 = y C 2 − R 1 + 1 − y − C 2 − R 1 − P 2 L , (16)

G ¯ = xG 3 + 1 − x G 4 . (17)

TABLE 5. Payoff matrix of the government and the platform under differentiated supervision.

Consider Equations 18–21:

G y = C 2 − C 1 + 2 R 1 − y g y S 1 + 1 − y g y F 1 − 1 − y P 1 − P 2 L , (18)

H 3 = x − C 3 + E + g y S 1 + S 2 + R 2 + 1 − x − C 3 + R 2 + E , (19)

H 4 = x − C 4 − g y F 1 + F 2 − R 2 + 1 − P 1 E + 1 − x − C 4 − R 2 + 1 − P 2 E , (20)

H ¯ = yH 3 + 1 − y H 4 . (21)

Next, consider Equation 22:

J x = C 4 − C 3 + 2 R 2 + P 2 E + x P 1 E − P 2 E + xg y S 1 + S 2 + F 1 + F 2 . (22)

The replicator dynamic equations under differentiated supervision are derived using the same procedure as that under unified supervision. Based on the payoff matrix in Table 5, and considering the dynamic supervision success rate under differentiated supervision, the government and platform replicator dynamic equations are obtained, as shown in Equations 23 and 24, respectively. To ensure the consistency and reproducibility of the derivation process, the two replicator dynamic equations are explicitly labeled as follows.

The government replicator dynamic equation under differentiated supervision is shown in Equation 23:

F x = dx dt = x G 3 − G ¯ = x 1 − x C 2 − C 1 + 2 R 1 − yg y S 1 + 1 − y g y F 1 − 1 − y P 1 − P 2 L . (23)

The platform replicator dynamic equation under differentiated supervision is shown in Equation 24:

F x = dy dt = y H 3 − H ¯ = y 1 − y C 4 − C 3 + 2 R 2 + P 2 E + x P 1 E − P 2 E + xg y S 1 + S 2 + F 1 + F 2 . (24)

Equations 23 and 24 together constitute the two-dimensional evolutionary dynamic system under differentiated supervision, namely, System (II). Compared with the equations under unified supervision, Equation 23 incorporates the dynamic supervision success rate under differentiated supervision. Equation 24 further incorporates the additional social reputational return and loss generated by external social forces. The subsequent equilibrium point analysis and Jacobian matrix analysis are both conducted based on System (II).

Let F x = F y = 0; there are five equilibrium points in the system (II): (0,0), (1,0), (0,1), (1,1), and (x 2 , y 2. Among them, (x 2 , y 2 can be calculated using Equation 25:

x 2 = C 3 − C 4 − 2 R 2 − P 2 E g y S 1 + S 2 + F 1 + F 2 + P 1 E − P 2 E y 2 = C 1 − C 2 − 2 R 1 − g y F 1 + P 1 L − P 2 L − g y F 1 + S 1 − P 1 L + P 2 L (25)

Based on System (II), the corresponding Jacobian matrix J 2 is constructed using Equation 26:where a 11 and a 22 can be calculated using Equation 27:

J 2 = ∂ F x ∂ x ∂ F x ∂ y ∂ F y ∂ x ∂ F y ∂ y = a 11 a 12 a 21 a 22 , (26)

a 11 = 1 − 2 x C 2 − C 1 + 2 R 1 − y 1 − y Q S 1 + 1 − y 1 − y Q F 1 − 1 − y P 1 − P 2 L a 12 = x 1 − x 2 y − 1 Q S 1 + 2 y − 2 Q F 1 + P 1 − P 2 L a 21 = y 1 − y P 1 E − P 2 E + 1 − y Q S 1 + S 2 + F 1 + F 2 a 22 = 1 − 2 y C 4 − C 3 + 2 R 2 + P 2 E + x P 1 E − P 2 E + x 1 − y Q S 1 + S 2 + F 1 + F 2 (27)

Table 6 reports the determinant and trace values of the equilibrium points in System (II).

TABLE 6. Determinant and trace values of equilibrium points in System (II).

The stability of equilibrium points in System (II) is determined using the same trace-determinant criterion as in System (I). By substituting each equilibrium point into the Jacobian matrix J 2, the signs of the characteristic roots are identified, and the corresponding stability results are reported in Table 7.

TABLE 7. Stability analysis of System (II) under differentiated supervision.

Table 7 shows that the boundary equilibrium points (0,0), (1,0), (0,1), and (1,1) are unstable. Therefore, the stability of the internal equilibrium point x 2 , y 2 is further analyzed in Proposition 2.

Proposition 2 In the differentiated supervision model, the eigenvalue analysis of the Jacobian matrix shows that the internal equilibrium point x 2 , y 2 has a pair of complex conjugate eigenvalues with negative real parts. Therefore, the system trajectories exhibit a spiral convergence toward the equilibrium point and eventually approach a stable state. Accordingly, the “Stable” result reported in Table 7 should be interpreted, in terms of dynamical systems theory, as an asymptotically stable equilibrium. Furthermore, within the framework of replicator dynamics, this asymptotically stable equilibrium can be further interpreted as a strategy state with evolutionary stability characteristics (ESS), reflecting a stable game equilibrium formed during the process of strategic adjustment. Lyapunov stability is used for dynamical characterization, while ESS is discussed only as a behavioral interpretation. Examining the impact of related parameters on the strategic choices of the government and platform under differentiated supervision with regard to the point (x 2 , y 2, Equation 28 can be obtained: Furthermore, due to the dependence of the supervision success-rate function g(y) = Q(1 − y) on the platform strategy variable y in the differentiated supervision model, the internal equilibrium point x 2 , y 2 presented in Equation 28 does not admit an explicit closed-form solution. Instead, it is determined as an implicit fixed-point system jointly defined by the replicator dynamic equations of the government and the platform, requiring both equations to simultaneously equal zero. Therefore, the internal equilibrium point must be obtained through a simultaneous solution of Equation 28 rather than derived from an analytical expression. Moreover, the internal equilibrium is economically meaningful only when it satisfies the feasibility conditions 0 < x 2 < 1 , 0 < y 2 < 1, ensuring that it lies within the interior of the strategy space.

Each element’s first-order partial derivatives can be found to provide Equations 29, 30:

∂ x 2 ∂ Q < 0 , ∂ y 2 ∂ R 2 < 0 , ∂ x 2 ∂ C 4 < 0 , ∂ x 2 ∂ C 3 > 0 , ∂ x 2 ∂ S 1 < 0 , ∂ x 2 ∂ S 2 < 0 , ∂ x 2 ∂ F 1 < 0 , ∂ x 2 ∂ F 2 < 0 , (29)

∂ y 2 ∂ Q > 0 , ∂ y 2 ∂ R 1 > 0 , ∂ y 2 ∂ C 1 < 0 , ∂ x 2 ∂ C 2 > 0 , ∂ y 2 ∂ S 1 > 0 , ∂ y 2 ∂ F 1 > 0 . (30)

Proposition 2 indicates that, under differentiated supervision, System (II) converges to a stable evolutionary equilibrium at x 2 , y 2. Unlike unified supervision, differentiated supervision introduces a dynamic supervision success rate and a combined mechanism of governmental reward–punishment and social reputational feedback, which improve the alignment between supervisory intensity and platform behavior. As a result, the system is more likely to evolve toward a stable governance outcome.

More specifically, differentiated supervision improves governance stability in two ways. First, it allows supervisory resources to be adjusted according to participation behavior and disclosure risk, rather than being allocated uniformly. Second, it strengthens the incentive effect of the reward–punishment mechanism by combining formal supervision with social co-governance. Therefore, compared with unified supervision, differentiated supervision is better suited to the heterogeneous governance environment of security crowdsourcing platforms.

2.2.3 Data sources and parameter setting basis

This study is a theory-driven analytical modeling study rather than a benchmark-based prediction study. Accordingly, it does not rely on a single training or testing dataset. Instead, the model structure and parameter setting are informed by three types of sources: policy and regulatory texts that support the institutional logic of supervision, public platform and industry information that reflects the operational characteristics of vulnerability disclosure and bug bounty mechanisms, and prior studies on security crowdsourcing governance and vulnerability disclosure that provide a basis for parameter calibration in numerical simulation. The numerical analysis is therefore based on parameterized simulation for mechanism comparison rather than on predictive benchmarking against labeled datasets. To ensure the comparability of model parameters and avoid the influence of measurement units on the evolutionary outcomes, all parameters were transformed into dimensionless quantities. Their values are expressed in terms of relative benefits and relative costs, so that they represent the relative strength of different factors rather than absolute quantities observed in practice. On this basis, the parameters were normalized according to the model assumptions and their relative relationships, allowing meaningful comparison and analysis on a common scale.

This parameter-setting logic is appropriate because the purpose of the simulation is to compare the dynamic governance consequences of alternative supervisory regimes under different institutional conditions. The simulation is used to examine governance stability, sensitivity to initial conditions, and the effects of key parameters such as supervision cost, reputational feedback, supervisory capability, and reward–punishment mechanisms. In this sense, the numerical analysis serves as an extension of the theoretical model and as a way to translate the analytical results into comparative insights on collective regulatory dynamics.

To further improve the transparency of the parameter setting, Table 8 summarizes the symbol, definition, parameter category, baseline value, theoretical constraint, reference basis, and economic interpretation of each model parameter. The baseline values were determined according to relevant policy documents, previous evolutionary game studies, and the model assumptions and were assigned under the corresponding theoretical constraints. In addition, the selected baseline parameters satisfy the basic requirements for the stability analysis of the proposed model and ensure the existence of the internal equilibrium under the corresponding conditions, thereby maintaining the theoretical consistency of the numerical simulations [29, 31, 44, 45]. All economic interpretations are conceptual mappings rather than empirical calibrations.

TABLE 8. Baseline parameter values, theoretical constraints, reference basis, and economic interpretation.

The numerical simulations are not intended to estimate a specific real-world platform. Instead, they are designed to examine whether the theoretical mechanism remains valid under different initial strategy probabilities and key parameter changes. Therefore, the simulation results should be interpreted as mechanism-oriented robustness analysis rather than as empirical prediction.

3 Results

To examine the robustness of the simulation results, we do not rely on a single baseline scenario. Instead, we conduct a series of parameter sensitivity analyses by changing initial strategy probabilities, reputational feedback, differentiated supervisory capability, governmental reward and punishment, and joint reward–punishment mechanisms. These analyses allow us to observe whether the relative advantage of differentiated supervision remains stable under different behavioral and institutional conditions. The simulation results reported in Figures 1–13 therefore serve two purposes: first, to illustrate the dynamic trajectories predicted by the theoretical model; and second, to test whether the main conclusion is robust to changes in key parameters.

To compare the governance outcomes under unified supervision and differentiated supervision and to examine how changes in key parameters affect the strategic choices of the government and the platform, we conduct numerical simulations of System (I) and System (II) in MATLAB.

In evolutionary game studies, numerical simulation is mainly used to analyze how changes in key parameters affect the strategic evolution paths and equilibrium stability of boundedly rational players. It is not used to directly predict real-world scenarios. Drawing on the parameter-setting methods in the study on multi-agent regulatory evolutionary games by Liang et al. and the study on evolutionary games under governmental reward-punishment mechanisms by Gao et al., the parameter values in this study are not directly taken from a single policy text or literature case. Instead, they are set comprehensively according to the economic meanings of the model assumptions, the relative relationships among variables, and the comparability between unified supervision and differentiated supervision [46, 47].

The parameter setting follows a parameterized simulation logic rather than a benchmark-dataset design. First, based on the policy text analysis of the People’s Republic of China Cybersecurity Law, the government’s supervision costs are set as C 1 = 15 and C 2 = 5.5. Second, drawing on public platform-related information, the platform’s participation costs are set as C 3 = 9 and C 4 = 3. Third, based on prior studies and the simulation requirements of the model, the remaining parameters are set as follows: F 1 = 2 , R 1 = 4 , S 1 = 1 , P 1 = 0.4 , P 2 = 0.6 , E = 1 , L = 2 , Q = 0.8 , S 2 = 1 , and F 2 = 1.5. These values provide the baseline configuration for the subsequent simulations, following the general logic of prior studies on bug bounty governance and security crowdsourcing regulation [1, 23–25].

Substituting the parameter values into the two systems yields the corresponding evolutionary paths under unified supervision and differentiated supervision. The simulation results are used to compare whether the two supervisory regimes generate convergence toward stable governance outcomes or cyclical instability under different parameter settings. In line with the analytical framework, the focus of the simulation is not on prediction, but on mechanism comparison and policy interpretation.

3.1 Stability analysis of the system under different supervision mechanisms

Substituting the above parameter values into Systems (I) and (II), the evolutionary paths of the two supervisory regimes can be obtained, as shown in Figures 1, 2.

Figure 1 shows that under unified supervision, the evolutionary path of System (I) forms a closed-loop elliptic trajectory around x 1 , y 1 and does not converge to an evolutionary stable strategy. This indicates that the strategic choices of the government and the platform fluctuate periodically around x 1 , y 1 and that the system remains in a state of cyclical oscillation rather than stable coordination.

Figure 2 shows that, under differentiated supervision, the strategic choices of both parties become stable after a period of fluctuation, and the trajectory of System (II) gradually converges to x 2 , y 2. This suggests that differentiated supervision is more conducive to stable governance outcomes than unified supervision. The reason is that differentiated supervision adjusts supervisory resources according to platform participation levels and disclosure risk while also using more flexible reward–punishment arrangements. As a result, the platform’s probability of active participation gradually stabilizes over time, and the system evolves toward equilibrium.

The convergence result in Figure 2 can also be explained by real-world vulnerability disclosure governance practices. Platforms such as Bugcrowd and HackerOne provide vulnerability disclosure or bug bounty services to organizations. These services support report intake, vulnerability triage, validation, communication coordination, and process management [48, 49]. By contrast, small GitHub repositories or open-source projects can receive private vulnerability reports from researchers through private vulnerability reporting, but their handling process relies more on the maintainers’ own time, security expertise, and coordination resources. Therefore, the gradual convergence of the differentiated supervision system in Figure 2 is that when the government provides guidance according to platform participation behavior and governance capacity and when platform-based processes or supportive tools reduce participation costs, the probability of active platform participation becomes more stable. As a result, the system is more likely to evolve toward a stable governance state [50].

3.2 Effect of different initial probabilities on platform strategies

To examine whether the initial strategic state affects the platform’s evolutionary outcome, the initial probabilities x and y are varied between 0.3 and 0.7 while keeping all other parameters unchanged. The results are shown in Figures 3, 4.

Figure 3 shows that under unified supervision, the initial probabilities of the government’s and platform’s strategies continuously affect the platform’s evolutionary path, and the system continues to fluctuate over time. The platform’s probability of active participation changes in line with the government’s initial strict-supervision probability, and the fluctuations are larger when x = 0.7 than when x = 0.3. This indicates that under unified supervision, the system remains sensitive to initial conditions and does not develop a stable governance trajectory.

Figure 4 shows that under differentiated supervision, changes in the initial values of x and y do not change the platform’s final strategic choice, although they affect the magnitude of short-term fluctuations and the time required to reach equilibrium. Compared with the case in which the initial active-participation probability is = 0.7, the platform is more sensitive to the government’s initial strict-supervision probability when y = 0.3, and the convergence process takes longer. This suggests that when the platform initially shows weak willingness to participate, stronger government supervision and guidance are needed to accelerate convergence toward active participation.

This implies that differentiated supervision is more robust to uncertain initial conditions, which is particularly valuable in platform ecosystems characterized by bounded rationality and incomplete information.

3.3 Effect of feedback in social reputation on both game parties’ behaviors

To further analyze the role of reputational feedback under differentiated supervision, the baseline initial values are set as x = 0.7 and y = 0.3, while the remaining parameters remain unchanged. The results are shown in Figures 5, 6.

3.3.1 Effect of government’s social reputation return

To evaluate the effect of government reputational return, R 1 is set to 3, 4, and 5, respectively, while all other parameters remain unchanged. The results are shown in Figure 5.

As R 1 increases, the probabilities that the government chooses strict supervision and that the platform chooses active participation both increase over time until the system becomes stable. When R 1 = 5, the government obtains sufficiently strong reputational return from strict supervision, which provides stronger incentives to maintain high supervisory intensity and, in turn, encourages active platform participation. By contrast, when R 1 decreases, the incentives for strict government supervision and active platform participation both weaken. When R 1 = 3, both parties eventually stabilize in an inactive state, creating a governance dilemma. These results suggest that stronger reputational feedback to the government helps improve the supervisory environment and promotes more stable governance.

3.3.2 Effect of the platform’s social reputation return

To evaluate the effect of the platform’s reputational return, R 2 is set to 1, 2, and 3, respectively, while all other parameters remain unchanged. The results are shown in Figure 6.

The simulation shows that the probability of platform active participation is positively associated with R 2, whereas the probability of government strict supervision is negatively associated with R 2.

Higher R 2 increases the platform’s incentive to participate actively, which improves disclosure governance and reduces the need for high-frequency government intervention. Conversely, when R 2 is low, the platform’s probability of active participation decreases over time and eventually stabilizes at a lower level. In that case, the government needs to strengthen strict supervision, thereby inducing the platform to adopt the active strategy. This result highlights the importance of reputational incentives in reducing governance pressure on the government while encouraging voluntary platform participation.

3.4 Effect of differentiated supervision on both parties’ strategic choices

This subsection examines how changes in differentiated supervision affect the strategic evolution of the government and the platform under differentiated supervision.

3.4.1 Effect of the government’s strict-supervision costs

To evaluate the effect of the government supervision cost, C 1 is set to 12, 15, and 18, respectively, while all other parameters remain unchanged. The results are shown in Figure 7.

The simulation shows that the probabilities of government strict supervision and platform active participation are both negatively associated with C 1. When C 1 is high, the government faces stronger budget pressure in sustaining high-intensity supervision, which weakens its willingness to maintain strict supervision. The resulting reduction in external constraints also lowers the platform’s incentive to participate actively. By contrast, when C 1 is reduced, the government can sustain supervision more effectively, which, in turn, promotes a higher level of platform participation. These results indicate that reducing the cost of strict supervision—for example, through process simplification, technological upgrading, and improved information-sharing mechanisms—can improve the efficiency of supervisory governance.

3.4.2 Effect of the supervision success-rate ceiling

To evaluate the effect of the supervision success-rate ceiling, Q is set to 0.2, 0.8, and 1, respectively, while all other parameters remain unchanged. The results are shown in Figure 8.

The simulation shows that the probability of government strict supervision is negatively associated with Q, whereas the probability of platform active participation is positively associated with Q. As Q increases, the probability that white-hat vulnerability disclosure behaviors are effectively supervised also increases, and the platform becomes more responsive to the associated reward–punishment mechanism. This strengthens the platform’s incentive to participate actively. At the same time, higher Q allows the government to achieve stable supervisory effectiveness with lower resource input, which reduces its need for frequent strict supervision. In practical terms, this result implies that improving supervisory accuracy, staff capability, technical support, and the overall supervision chain can enhance governance efficiency.

3.5 Effect of joint reward and punishment on both parties’ strategic choices

This subsection examines how joint reward–punishment mechanisms affect the strategic evolution of the government and the platform under differentiated supervision.

3.5.1 Effect of the government’s reward and punishment

To examine the effect of the government’s reward and punishment, F 1 is set to 0, 2, and 4, and S 1 is set to 0, 1, and 4, respectively, while all other parameters remain unchanged. The results are shown in Figure 9.

When F 1 = S 1 = 0, the platform lacks sufficient incentive to choose active participation, and education alone cannot produce an efficient supervisory outcome. Over time, the government’s own incentive to maintain strict supervision also weakens because of limited budget and decreasing governance returns, which leads the system toward lax supervision. As government reward and punishment increase, the difference between the platform’s strategic payoffs becomes more pronounced, and the platform is more likely to choose active participation. This indicates that the government’s direct reward–punishment mechanism remains a fundamental tool for constraining platform behavior and improving governance effectiveness.

3.5.2 Effect of additional reward and punishment from social forces

To examine the effect of additional reward and punishment from social forces, F 2 is set to 0, 1.5, and 4, and S 2 is set to 0, 1, and 4, respectively, while all other parameters remain unchanged. The results are shown in Figure 10.

It should be noted that the additional rewards and punishments generated by social forces are not always completely fair. Although the simulation results show that increasing S 2 or F 2 can strengthen the incentive for the platform to choose active participation in vulnerability disclosure governance, public evaluation and media responses do not necessarily correspond to the technical severity of vulnerabilities. Drawing on the study by Syed et al. on how social media exposure of software vulnerabilities affects vendor patch response behavior, social media exposure may amplify the external reputational pressure faced by vendors. For small platforms or open-source communities that lack public communication resources, an overly strong F 2 may lead to excessive reputational punishment. Therefore, S 2 and F 2 should be used together with the technical severity of vulnerabilities, platform governance capacity, and actual participation behavior [42].

The simulation shows that the probability of government strict supervision is negatively associated with the additional reward and punishment imposed by social forces. As F 2 and S 2 increase, the government’s strategic choice fluctuates more noticeably before reaching stability, while the payoff gap between the platform’s alternative strategies also becomes larger. In the short run, stronger social reward and punishment can effectively motivate active platform participation. Over time, however, the incentive effect of social forces alone remains limited. After a period of evolution, the platform may reduce its participation and shift back toward negative participation, which again requires the government to intensify supervision. Therefore, although social forces can complement formal supervision, the government’s supervisory role remains indispensable. A more effective governance outcome requires a balanced and reasonable joint reward–punishment mechanism that combines governmental supervision with social co-governance.

Therefore, when interpreting the simulation results for S 2 and F 2, they should be regarded as reflecting the incentive and constraint effects of social feedback on platform participation behavior, rather than as direct measures of the objective security level. If social feedback is disconnected from the technical severity of vulnerabilities, actual remediation effectiveness, and platform governance capacity, overly strong social reputational rewards and punishments may lead the platform to focus more on externally visible compliance performance than on substantive vulnerability governance. This may create the risk of superficial security.

Overall, the robustness checks show that differentiated supervision maintains a stronger tendency toward stable convergence across different initial probabilities and parameter changes. Although the convergence speed and trajectory shape vary with reputational feedback, supervisory capability, and reward–punishment intensity, the qualitative conclusion remains consistent: differentiated supervision is more effective than unified supervision in guiding the government–platform system toward a stable governance equilibrium. This finding supports the theoretical proposition that governance stability in vulnerability disclosure platforms depends on adaptive supervisory intensity rather than on uniform regulatory pressure.

3.6 Stability transition analysis under differentiated supervision

To further examine the stability transition of the differentiated supervision system under changes in key parameters, we conduct heatmap and bifurcation diagram analyses based on System (II). Drawing on the studies by Bian et al. and Zhang and Lu, who used heatmaps and bifurcation diagrams to identify stability changes in dynamic systems, we select Q, S 2, and F 2 as the main variables because they directly affect the supervision success rate and the social reputation feedback mechanism [51, 52]. Except for the analyzed variables, the other parameters are kept at the baseline values under differentiated supervision. Figure 11a sets Q ∈ 0.2 , 1.2 and S 2 ∈ 0 , 3. Figure 11b sets Q ∈ 0.2 , 1.2 and F 2 ∈ 0 , 4. Figure 11c changes only Q under the baseline level of social reputation feedback. To identify the numerical transition boundary, we use the oscillation amplitude of y in the later stage of evolution, A y = max y t − min y t, as the criterion. The threshold A y = 0.05 is used to distinguish the periodic fluctuation region from the stable convergence region.

Figure 11a shows the oscillation amplitude of y when Q and S 2 change together. When the upper bound of the supervision success rate and the additional social reputation reward are both low, the system is more likely to remain in the periodic fluctuation region. As Q or S 2 increases, the oscillation amplitude of y gradually decreases, and the system moves toward the stable convergence region. Following the same criterion as in Figures 11a,b, we further examine the joint effect of Q and F 2. The results show that a higher upper bound of the supervision success rate and a stronger additional social reputation punishment can strengthen the constraint on the platform’s negative participation, thereby reducing system fluctuation and improving system stability. Figure 11c presents the bifurcation pattern of the platform’s active participation probability y with changes in Q under the baseline level of social reputation feedback. When Q is low, the long-term values of y are relatively dispersed, indicating periodic fluctuation. When Q exceeds the numerical critical point Q c, the long-term values of y gradually converge, which indicates that the platform’s active participation strategy becomes stable.

These results indicate that the stability of differentiated supervision depends not only on the increase in the upper bound of the supervision success rate but also on the joint effects of the additional social reputation reward and the additional social reputation punishment. A higher supervision identification capability, a reasonable positive reputation incentive, and an appropriate negative reputation constraint can reduce periodic fluctuations in the strategic adjustment of the government and the platform. They also help promote the stable evolution of the platform’s active participation in vulnerability disclosure governance.

3.7 Robustness analysis of evolutionary dynamics

To further examine the robustness of the model results under different parameter settings and a broader parameter space, this section extends the previous one-dimensional sensitivity analysis by conducting additional evaluations from two perspectives: parameter space expansion and functional form extension.

3.7.1 Robustness analysis under expanded parameter space

The previous analysis has examined the effects of parameters such as reward mechanisms, punishment mechanisms, and social reputational feedback on the evolutionary dynamics of the system. These parameters primarily influence the adjustment of local payoff structures and convergence speed while having a relatively limited impact on the global stability structure of the system. Therefore, they are not suitable as primary variables for analyzing changes in the stability region.

In contrast, the supervision cost C 1 and supervisory capability Q characterize the intensity of regulatory resource investment and the efficiency of regulatory implementation, respectively. Both directly affect the realization level of the supervision mechanism and jointly determine the structural properties of the system’s evolutionary stability region. Specifically, the supervision cost reflects the resource constraint of regulatory implementation, while supervisory capability reflects the effectiveness of enforcement. Together, they constitute key control variables governing the equilibrium distribution of the system. Based on this, we select C 1 and Q as two-dimensional parameters for the extended parameter space analysis to investigate the overall variation of the stability structure under different regulatory resource allocation conditions.

In terms of the parameter exploration strategy, a grid-based parameter-space scanning method is adopted to systematically examine the impact of key regulatory parameters on the long-term evolutionary behavior of the system. Each grid point in the two-dimensional parameter space corresponds to a specific combination of (C 1, Q). Within the predefined parameter ranges, grid points are constructed for both C 1 and Q, and the replicator dynamic equations of the differentiated supervision model are solved for each parameter pair. The terminal value y T, representing the probability of active platform participation, is recorded for each simulation. Subsequently, a two-dimensional interpolation is applied to the discrete simulation results to generate a continuous parameter-space distribution map, which more clearly illustrates the stability regions and their critical boundaries under different parameter combinations.

The value of C 1 is anchored to the baseline points 12 , 15 , and 18 used in Figure 7 and is further extended symmetrically to C 1 = 9 , 12 , 15 , 18 , 21 with consistent step sizes to cover low, baseline, and high supervision cost scenarios. The range of Q is kept consistent with Figure 8, set as 0.2 ≤ Q ≤ 1.0, and discretized using a fine-grained uniform grid to identify the boundaries of the stability regions under different supervisory capability levels. All other parameters remain at their baseline values.

Figure 12 presents the distribution of the system’s terminal state y T under different parameter combinations. The results indicate a clear regional separation pattern: under conditions of low supervision cost and high supervisory capability, the system converges to a high-participation stable region. As supervision cost increases or supervisory capability decreases, the system gradually transitions toward a low-participation stable region, with a distinct intermediate transition zone emerging between the two regimes.

Compared with the one-dimensional sensitivity results in Figure 7, the direction of system transition from high participation to low participation induced by increasing supervision cost remains consistent. Similarly, consistent with the results in Figure 8, improvements in supervisory capability continue to promote convergence toward the high-participation region. Overall, these findings suggest that the fundamental stability structure of the system remains unchanged in a broader parameter space, thereby confirming the robustness of the conclusion that differentiated supervision enhances stable governance outcomes.

3.7.2 Robustness analysis under alternative functional specification

To further examine whether the conclusions in Figure 8 depend on the linear specification of the supervision success-rate function g y = Q 1 − y, this study extends the functional form while keeping the parameter settings of supervisory capability Q unchanged. Specifically, the values Q = 0.2 , 0.8 , and 1.0 are retained as in Figure 8, and the supervision success-rate function is generalized to a nonlinear form: g y = Q 1 − y α.

Here, α = 1 corresponds to the baseline linear specification used in the previous analysis, whereas α < 1 and α > 1 represent weaker and stronger nonlinear sensitivities of supervision success to the platform participation behavior, respectively. To ensure comparability with the baseline model, a perturbation approach around the linear case is adopted, and α = 0.5 , 1.0 , and 1.5 are selected to capture different curvature conditions while avoiding extreme parameter values that may generate unrealistic dynamical behaviors.

Figure 13 presents the evolutionary trajectories of the platform’s probability of active participation under different functional forms and supervisory capability levels Q = 0.2 , 0.8, and 1.0. The results indicate that variations in the functional form primarily affect the convergence speed and transient dynamics of the system, whereas the long-term evolutionary direction remains unchanged. When supervisory capability is relatively high, the platform’s active participation probability converges rapidly to a high level under all functional specifications. When supervisory capability is low, the convergence speed decreases, but the overall evolutionary tendency remains consistent across different values of α.

Compared with the linear specification in Figure 8, the nonlinear supervision success-rate function does not alter the long-run stability structure of the system. This finding suggests that the main conclusion regarding the stabilizing effect of differentiated supervision is robust not only under linear functional assumptions but also under different nonlinear response forms, thereby further confirming the functional-form robustness of the model results.

4 Discussion

4.1 Interpretation of the main findings

The simulation results show that unified supervision and differentiated supervision generate substantially different governance outcomes. From the perspective of collective dynamics, the cyclical oscillations observed under unified supervision indicate that the proportions of agents adopting different strategies continue to adjust but do not reach a stable coordinated state. In contrast, the spiral convergence and stable equilibrium under differentiated supervision indicate that the government and vulnerability disclosure platforms gradually establish a stable collaborative governance pattern through continuous strategic adaptation. These evolutionary dynamics demonstrate how micro-level strategic adaptation generates macro-level governance patterns. Under unified supervision, the strategic choices of the government and the platform fluctuate cyclically and fail to converge to a stable evolutionary equilibrium. This suggests that a one-size-fits-all supervisory arrangement is insufficient to accommodate heterogeneity in platform participation, disclosure conditions, and governance risk. By contrast, under differentiated supervision, the system gradually converges toward a stable equilibrium through dynamic adjustment of supervisory intensity and incentive mechanisms. This finding indicates that vulnerability disclosure platforms are better governed through adaptive supervisory arrangements than through a one-size-fits-all logic.

A second important finding is that differentiated supervision reduces the long-term sensitivity of the system to initial strategic conditions. Under unified supervision, different initial values of the strategic probabilities lead to persistent cyclical fluctuations. Under differentiated supervision, by contrast, the initial conditions mainly affect the range of fluctuation and the speed of convergence rather than the final equilibrium outcome. This suggests that differentiated supervision provides a more robust governance mechanism in platform environments characterized by uncertainty, bounded rationality, and heterogeneous participation conditions.

A third finding is that governance stability depends on the joint configuration of reputational feedback, supervisory capability, and incentive arrangements. Stronger reputational feedback increases the incentives for both strict supervision and active platform participation, whereas high supervision cost weakens both parties’ willingness to sustain cooperative governance. Similarly, a higher supervision success-rate ceiling improves the platform’s motivation to participate actively and reduces the government’s need for frequent strict intervention. Although additional reward and punishment from social forces can strengthen participation incentives, they cannot replace formal government supervision in the long run. Stable governance, therefore, depends not only on supervisory effort but also on the alignment among supervision cost, reputational incentives, and institutional reward–punishment mechanisms.

Taken together, these findings suggest that vulnerability disclosure platforms should be governed as heterogeneous platform environments rather than as administratively uniform reporting systems. In such settings, participation behavior, disclosure risk, supervisory capacity, and reputational incentives interact dynamically. This interpretation is consistent with the broader platform-governance literature, which emphasizes that platform performance depends not only on formal rules but also on openness strategies, fairness arrangements, and organizational coordination burdens [12–14].

4.2 Theoretical implications

This study makes three main theoretical contributions.

First, it extends the vulnerability disclosure literature by reframing vulnerability disclosure platforms as a platform governance problem rather than as isolated technical reporting channels. Existing research has shown that disclosure outcomes are shaped by disclosure timing, legal arrangements, communication procedures, and vulnerability management infrastructure [4, 6, 8–10]. Building on this literature, the present study shows that disclosure governance is also structured by the supervisory regime under which governments and platforms interact. In this sense, the study shifts the analytical focus from individual disclosure acts to platform-level governance arrangements.

Second, this study contributes to research on platform-based cybersecurity governance by explicitly comparing unified supervision and differentiated supervision within a bug bounty and vulnerability disclosure context. Prior studies have examined participation incentives, governance mechanisms, platform openness, fairness problems, and market conditions in vulnerability disclosure ecosystems [1, 11–17]. However, limited attention has been paid to whether a uniform supervisory regime or a differentiated supervisory regime is more effective under platform heterogeneity. By showing that differentiated supervision is more likely to generate convergence toward a stable equilibrium, this study clarifies why adaptive governance may be theoretically preferable to uniform control in platform-based vulnerability management.

Third, the study contributes to digital platform governance research by showing that effective cybersecurity governance requires more than stricter control. The results indicate that governance stability depends on the joint configuration of supervision cost, reputational feedback, and reward–punishment arrangements. This insight complements recent work that considers bug bounty platforms two-sided digital intermediaries and organizational settings that generate substantial coordination burdens for managers [11, 14]. From this perspective, differentiated supervision can be understood as a governance mechanism that better aligns supervisory effort with platform heterogeneity, rather than as a simple intensification of regulatory pressure.

4.3 Practical implications

The findings of this study provide several practical implications for governments and vulnerability disclosure platforms.

First, governments should avoid relying on a one-size-fits-all supervisory logic when governing vulnerability disclosure platforms. The results show that unified supervision is prone to cyclical instability, whereas differentiated supervision is more likely to produce stable governance outcomes. This suggests that supervisory intensity should be adjusted according to platform conditions, disclosure risk, and governance capacity rather than applied uniformly across all platform environments.

Second, regulators should pay close attention to supervisory capability and cost efficiency. These findings further suggest that differentiated supervision should emphasize the efficient allocation of supervisory resources, rather than simply increasing supervisory intensity. In practice, governments should allocate supervisory resources according to platform participation and disclosure risk, thereby improving supervisory efficiency in high-risk platforms and governance scenarios. This recommendation is consistent with recent studies emphasizing resource allocation optimization as an effective approach to cybersecurity risk governance. The simulations indicate that a lower supervision cost and a higher supervision success-rate ceiling improve the sustainability of governance. In practice, this implies that improving regulatory capability, information-processing capacity, and coordination efficiency may be more effective than merely increasing supervisory intensity. Strengthening the quality of supervision is therefore at least as important as expanding its scope.

Third, reputational mechanisms should be treated as part of the governance infrastructure rather than as secondary factors. Stronger reputational feedback improves both governmental willingness to supervise and platform willingness to participate actively. This implies that vulnerability disclosure governance can be strengthened by institutional arrangements that increase transparency, reinforce accountability, and make platform compliance more visible to external stakeholders.

Fourth, formal governmental supervision should be combined with platform-level and social incentive mechanisms. The results show that joint reward–punishment mechanisms can strengthen active participation, but they do not eliminate the need for government supervision. This suggests that social co-governance, reputation systems, and community-based incentives may complement formal regulation, but they should not be expected to replace state supervision in heterogeneous and risk-sensitive platform environments.

Finally, platform operators should recognize that governance quality depends not only on reward size or reporting volume but also on platform organization. Prior research has shown that openness, fairness, responsiveness, and coordination burden all affect platform legitimacy and participation quality [12–14]. The present study further shows that these governance conditions also shape the effectiveness of supervisory design. Platforms should, therefore, treat disclosure governance as an integrated problem involving participation management, disclosure risk, internal coordination, and institutional trust.

It should be noted that, in reality, some small platforms and open-source communities are often constrained by security expertise, maintenance time, financial input, and infrastructure conditions. They may “want to participate but lack resources.” By contrast, large technology companies may have stronger governance capacity, but they may still choose negative participation because of cost, reputation, or strategic considerations. If differentiated supervision cannot distinguish between a platform’s willingness to participate and its participation capacity, it may create “discriminatory boundaries.” In this case, resource-deficient platforms may be unfairly punished and excluded from the market. Therefore, when implementing differentiated supervision, the government can draw on the study by Wermke et al. on security and trust practices in open-source software projects and the study by Ayala et al. on open-source maintainers’ experience in handling bug bounty reports. Specifically, when the government implements differentiated supervision according to the platform’s level of participation, they should examine both the platform’s willingness to participate and its governance capacity [53, 54].

In addition, differentiated supervision and strong reward–punishment mechanisms should avoid further increasing the compliance threshold for platforms and the reporting threshold for white-hat hackers. For platforms, if regulatory rules overemphasize high-intensity compliance and punishment, large enterprises with sufficient resources may be better able to bear institutional costs, whereas small platforms and disadvantaged participants may face higher barriers to entry. For white-hat hackers, communication barriers, the cost of understanding rules, response uncertainty, and a sense of community exclusion in the vulnerability reporting process may affect the continuous participation of white-hat hackers from different backgrounds. Therefore, drawing on the study by Akgul et al. on the challenges and benefits of bug bounty participants and the study by Fulton et al. on marginalized experiences in vulnerability discovery, the government should consider both platform-side compliance burden and white-hat-side reporting accessibility when designing differentiated supervision and reward–punishment mechanisms. It should maintain a clear, low-threshold, and explainable vulnerability reporting process [55, 56].

On this basis, differentiated supervision can further move toward capability-based regulatory policy and introduce reasonable accommodation for small-scale platforms. For small-scale platforms, non-profit organizations, and resource-constrained open-source projects, the government should not rely only on monetary penalties. Instead, they should provide reasonable accommodation according to their governance capacity and resource conditions. These measures may include applicable exemptions, reduced monetary penalties, technical assistance, vulnerability disclosure templates, reporting process guidelines, infrastructure support, and time-limited rectification. The NIST Cybersecurity Framework 2.0 Small Business Quick Start Guide is designed for small and medium-sized enterprises with limited cybersecurity planning capacity. It can also help smaller organizations, such as non-profit organizations and schools, start cybersecurity risk management. The European Commission’s explanation of the Cyber Resilience Act and open-source software also reflects the idea of differentiated governance according to the degree of commercialization of open-source software. Therefore, the government can provide alternative support for agents that are resource-constrained but willing to participate. At the same time, it should retain necessary punishment constraints for platforms that have governance capacity but remain negative participants over time. In this way, differentiated supervision can maintain governance constraints while avoiding the exclusion of small-scale platforms, open-source communities, and disadvantaged white-hat hackers from the vulnerability disclosure governance ecosystem [57, 58].

The numerical simulation results not only demonstrate that differentiated supervision promotes the stable evolution of the system but also reveal that different parameters jointly affect system stability by influencing government supervisory behavior and platform participation strategies. Therefore, the key parameters in the proposed model can be mapped to corresponding policy instruments in practice, providing more targeted implications for vulnerability disclosure governance.

From the perspective of the model mechanism, reducing the government supervision cost (C 1) increases the government’s willingness to adopt the strict supervision strategy. This finding suggests that regulatory information infrastructure should further be improved by promoting automated vulnerability monitoring, intelligent supervisory platforms, and optimized supervisory procedures, thereby reducing regulatory resource input and improving supervisory efficiency. Increasing supervisory capability (Q) expands the stable region of the system and encourages active platform participation, indicating that greater efforts should be devoted to strengthening vulnerability identification, risk assessment, and cross-departmental supervisory coordination to improve the accuracy and effectiveness of supervision. Regarding the formal reward–punishment mechanism (S 1 , F 1), the simulation results indicate that an appropriate balance between rewards and penalties effectively encourages active platform participation in vulnerability disclosure governance. Therefore, a dynamic reward–punishment mechanism linked to platform governance performance should be established to strengthen both incentive and disciplinary effects. In addition, the social reputational feedback mechanism (S 2 , F 2) further reinforces the effectiveness of formal supervision, suggesting that information disclosure, industry evaluation, social oversight, and public guidance should be improved to foster a balanced and constructive social reputational feedback mechanism, thereby strengthening the synergy between formal supervision and social oversight.

4.4 Limitations and future research

This study has several limitations that point to directions for future research.

First, the model simplifies platform and participant heterogeneity into a limited number of strategies and parameters. Although this simplification is necessary for analytical tractability, future studies should incorporate richer forms of heterogeneity, such as differences in platform openness, disclosure quality, researcher experience, or vulnerability severity. Recent bug bounty research suggests that public and private programs differ substantially in the quality and uniqueness of submissions, indicating that openness structure may be an important extension of the present framework [12].

Second, the present study does not explicitly model operational burdens such as disclosure triage, duplicate handling, or internal coordination on the client side. However, recent work on bug bounty platforms shows that managing large volumes of reports, identifying asset owners, and negotiating disclosure schedules impose substantial articulation work on program managers [14]. Incorporating such organizational frictions into future modeling could improve the realism of supervisory analysis.

Third, although the numerical simulation is grounded in policy logic, public platform information, and prior literature, the study remains an analytical modeling exercise rather than a large-scale empirical validation. Future research should combine analytical modeling with empirical platform data, disclosure records, or longitudinal evidence from vulnerability management systems to further examine the external validity of the proposed governance mechanisms.

In addition, in this study, we mainly describe platform heterogeneity from the perspective of participation level, namely, by distinguishing between active participation and negative participation. It has not yet incorporated differences in capital strength, governance resources, and social influence into the model. Future research can further construct asymmetric evolutionary game models that consider resource disparities to analyze the strategic evolution of different types of platforms under differentiated supervision.

Therefore, an important direction for future research is to construct evolutionary game model that explicitly incorporates resource asymmetry. Such a model can describe strategic interactions in contexts where there are large platforms, small platforms, commercial vulnerability disclosure platforms, and open-source communities. Cybersecurity governance should not be designed as a mechanism that only allows resource-rich agents to survive more easily. Instead, while improving the efficiency of vulnerability disclosure governance, it should also protect the participation space and ecosystem diversity of different types of platforms and security researchers in the vulnerability disclosure ecosystem.

More broadly, future research should also examine whether the present argument extends to other digital platform environments characterized by heterogeneous governance capacity, variable compliance risk, and strong coordination dependence. Such extensions would help clarify the broader relevance of differentiated supervision beyond the specific context of vulnerability disclosure platforms.

5 Conclusion

This study examines the governance of vulnerability disclosure platforms by comparing two supervisory regimes, namely, unified supervision and differentiated supervision. To address this problem, we develop an evolutionary game model between the government and the platform and analyze the effects of supervision cost, reputational feedback, supervision capability, and joint reward–punishment mechanisms through numerical simulation.

This study further clarifies the linkage between the model parameters, the underlying mechanisms, and practical governance instruments. The results indicate that key factors, including government supervision cost, supervisory capability, the formal reward–punishment mechanism, and the social reputational feedback mechanism, jointly influence the stable evolution of the system by affecting government supervisory behavior and platform participation strategies. Accordingly, reducing government supervision costs, enhancing supervisory capability, optimizing the formal reward–punishment mechanism, and promoting balanced social reputational feedback constitute important policy pathways for improving the differentiated supervision system and strengthening collaborative governance of vulnerability disclosure platforms. These practical implications are directly derived from the model mechanisms and analytical results and provide a theoretical basis and decision-making reference for optimizing vulnerability disclosure governance policies.

The results show that the two supervisory regimes generate substantially different governance outcomes. Under unified supervision, the strategic interaction between the government and the platform remains in cyclical fluctuation and does not converge to a stable evolutionary equilibrium. Under differentiated supervision, by contrast, the system gradually converges to a stable equilibrium through dynamic adjustment of supervisory intensity and incentive mechanisms. This finding indicates that differentiated supervision is more effective than unified supervision in governing vulnerability disclosure platforms under heterogeneous platform conditions.

The results further show that governance effectiveness depends on the joint configuration of several key factors. Lower supervision cost and stronger supervisory capability improve the sustainability of governance. Stronger reputational feedback encourages both strict supervision and active platform participation. Governmental reward–punishment mechanisms remain essential for constraining platform behavior, whereas additional reward and punishment from social forces can enhance governance in the short run but cannot replace formal supervision in the long run. Stable governance therefore requires not only supervisory effort but also effective alignment among supervision, reputation, and institutional incentives.

This study contributes to the literature in three ways. First, it extends research on vulnerability disclosure by framing vulnerability disclosure platforms as a platform governance problem. Second, it enriches research on security crowdsourcing and bug bounty governance by explicitly comparing unified supervision with differentiated supervision within one analytical framework. Third, it provides policy-relevant guidance for supervisory design in cybersecurity governance by showing when differentiated supervision is more likely to produce stable governance outcomes.

More broadly, the findings indicate that a one-size-fits-all supervisory logic is unlikely to generate stable outcomes in heterogeneous vulnerability disclosure platforms. Effective governance in such settings depends on how supervisory arrangements interact with platform heterogeneity, coordination burden, and governance risk over time. In this sense, the study speaks not only to vulnerability disclosure governance but also to the broader question of how heterogeneous multi-agent systems evolve under alternative supervisory regimes.

Generative AI statement

The author(s) declared that generative AI was used in the creation of this manuscript. During the preparation of this manuscript, the authors used ChatGPT (OpenAI) to support language refinement and structural editing. All generated content was carefully reviewed and revised by the authors, who take full responsibility for the final manuscript.

Any alternative text (alt text) provided alongside figures in this article has been generated by Frontiers with the support of artificial intelligence and reasonable efforts have been made to ensure accuracy, including review by the authors wherever possible. If you identify any issues, please contact us.

Publisher’s note

All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.

Footnotes

Edited by: The Anh Han, Teesside University, United Kingdom

Reviewed by: Zhang Zhipeng, Tianjin Polytechnic University, China

Pan Du, Nanjing University of Science and Technology, China