What is the Security Update Validation Program?

The Security Update Validation Program (SUVP) is a quality assurance testing program for Microsoft security updates, which are released on the second Tuesday of each month. The SUVP provides early access to Microsoft security updates—up to three weeks in advance of the official release—for the purpose of validation and interoperability testing. The program encompasses any Microsoft products for which we fix a vulnerability (e.g. Windows, Office, Exchange, or SQL Server) and is limited to trusted customers under NDA who have been nominated by a Microsoft representative.

The purpose of the SUVP is to validate Microsoft security updates against participants’ own test images and infrastructures as well as their line of business, third-party, and in-house apps. Issues found prior to public release are quickly escalated through the SUVP directly to the product teams and product managers or engineers that would need to be involved in authoring the fix. This enables rapid root cause analysis (RCA) and remediation, and fixes can be quickly validated with the reporting partner. To protect the confidentiality of privately reported vulnerability information, SUVP participants are not given vulnerability details and are contractually disallowed from reverse engineering the updates or otherwise verifying the effectiveness of the security measures being implemented.

The benefit of participating in the SUVP program is the ability to identify issues that would impact your business before Microsoft security updates are released broadly. Once identified, issues are quickly triaged and mitigated to the extent possible. This, in turn, allows you to keep your production Windows machines (or those of your customers) secure and up-to-date each month without concerns about regressions in functionality.

To be considered for participation in the SUVP, please have your Microsoft representative reach out to SUVP Onboarding at SUVPRecruit@microsoft.com to submit a nomination. The program requires that participants sign a SUVP contract and have an active Azure Active Directory (Azure AD) tenant to enable distribution of content via Microsoft Collaborate.