A notification window is the fixed period allowed to formally report a security issue after it has been identified. In cyber security, this usually applies to breaches, actively exploited vulnerabilities, or other incidents that must be escalated to regulators, customers, or partners within a defined deadline.
It matters because the clock can start before the full technical picture is known. Security teams must triage quickly, preserve evidence, and decide whether the event meets the reporting threshold. In practice, a notification window pushes organizations to build fast incident workflows, clear ownership, and reliable logging so they can prove what happened and when. Defenders use these controls to avoid late or incomplete reports; attackers may benefit when an organization is slow to classify exploitation or recognize that a serious incident has begun.