In the future, rather than hoard this information, the CIA and other intelligence agencies should commit to responsibly disclosing vulnerabilities it discovers to the private sector so that security holes can be patched.” The NSA does not disclose about 9 percent of the vulnerabilities that it finds, according to Castro.