> In a "mutual NDA", consideration is easy to find; each party agrees not to disclose confidential information disclosed by the counterparty. I don't think mut

> In a "mutual NDA", consideration is easy to find; each party agrees not to disclose confidential information disclosed by the counterparty. I don't think mutual NDAs are typical. Typically, you sign an NDA prior to receiving information. So the consideration for signing the NDA is receiving the information that you agreed to not disclose. If you already have that information, then that's no longer valid consideration. In this case, the reporter already knew the security vulnerability, so that knowledge could not be considered consideration. The bank would have needed to offer something else.