Unified versus differentiated supervision in vulnerability disclosure platforms: an evolutionary game analysis

Abstract

Vulnerability disclosure platforms have become important intermediaries in cybersecurity governance, where governments and platforms interact under conditions of information asymmetry, heterogeneous incentives, and dynamic strategic adaptation. A central question is whether such platforms should be governed through unified supervision or through differentiated supervision. To address this question, we develop an evolutionary game model between the government and the platform and use numerical simulation to compare the collective dynamics generated by alternative supervisory regimes. The results show that unified supervision tends to produce cyclical instability, whereas differentiated supervision is more likely to generate convergence toward a stable evolutionary equilibrium. The analysis further indicates that governance stability depends on the combined effects of supervision cost, reputational feedback, supervisory capability, and reward–punishment mechanisms. These findings suggest that vulnerability disclosure governance should be understood as a dynamic multi-agent system rather than a static regulatory arrangement. More broadly, this study contributes to the theoretical understanding of vulnerability disclosure platform governance and provides a new analytical perspective for the design of differentiated supervision mechanisms and collaborative platform governance.