In August of 2026, the National Vulnerability Database (NVD), operated by the National Institute of Standards and Technology (NIST), published a blog post, Shaping the NVD for the Future: We Need Your Feedback on AI-Enabled Vulnerability Management to kick off an open comment period through a Request for Information (RFI) posted on the Federal Register . I couldn’t be happier, so I wanted to make sure my vuln management friends were all aware of this opportunity to provide expert feedback.
Three Letter Acronyms (TLAs) #
But what is NVD, anyway? Unless you’re a super-nerd about all this coordinated vulnerability disclosure (CVD) stuff, you may only be vaguely aware of the subtle distinctions between these acronym-ized systems and programs that we all rely on to know what we’re talking about when we’re ferreting out vulnerabilities on the networks we’re responsible for.
CVE is the global vulnerability-naming dictionary, and lives mostly at cve.org. Strictly speaking, it’s really only interested in accurately identifying, naming, and cataloging technical vulnerabilities as they become publicly known. It’s not a government program (note the dot-org domain), but rather, an international, volunteer-led effort that, today, is funded solely by the U.S. Department of Homeland Security (DHS), through the Cybersecurity and Information Security Agency (CISA), and most of that paid-for infrastructure is operated by a non-profit, federally-funded research center (FFRDC), the MITRE corporation. There are several hundred CVE Numbering Authorities, ranging from software vendors, to national CERTs, to kind-hearted researchers. All together, this is where CVEs are born (and rarely, die). Today, it’s very weird to have a software vulnerability known for more than a few days without a CVE ID attached.
NVD on the other hand, is quite pointedly a federal government program, which I hope this blog’s opening paragraph makes clear. Traditionally, NVD takes CVEs and adds a bunch of follow-up information to them: elements like Common Vulnerability Scoring System (CVSS) metrics, Common Weakness Enumerations identifiers (CWE IDs) and Common Platform Enumeration (CPE) strings. NVD also happens to maintain the canonical CPE database, which is an effort to name all software, which is its own complicated program (someone wrote a book about Naming Things, and how it’s literally the hardest problem in computer science today), so if you want a CPE attached to a CVE, NVD is the source of truth for that.
So, CVE produces names for vulnerabilities, like “CVE-2025-8452,” and a basic description about how sensitive info is leaked from the named printer firmware versions. Then, NVD rolls in later to some context like, “How bad is this? It’s CVSS 4.3, so medium-bad! What kind of vulnerability is it? It’s a CWE-538, where bad guys can read secrets!”
Human Curation Cannot Keep Up #
Except, NVD hasn’t been enriching vulnerabilities with this kind of metadata consistently for the last couple of years, which is kind of a huge bummer. In 2024, the pace of vulnerability disclosure outstripped NVD’s capabilities, since it was all being human-curated. That, combined with some funding cuts has left NVD in this uncomfortable position of not being able to do even this minimum level of enrichment. This is, in turn, impacting how the U.S. federal government ingests and acts on the vulnerabilities of the day, since the USG is a major consumer of NVD’s downstream enrichment.
And as it happens, I’m sitting in on VulnCheck’s In the Wild webcast as I’m writing this blog, where this lagging problem is encapsulated in one slide:
So, NVD seems to be pretty well capped at about 30,000 vulnerabilities per year they can reasonably process, and they’re looking for strategies and solutions that get NVD fully back in the saddle, but at “machine-speed.” There’s no indication that vulnerability disclosures are going to slow down any time soon. It’s not entirely AI’s “fault,” but AI tooling is certainly “helping” more CNAs, more researchers, and more actual attackers fill the funnel on the front end of vulnerability disclosure.
AI: The cause of, and solution to, all our problems? #
There’s pros and cons with injecting LLM-based summarization techniques into vulnerability descriptions, categorizations, and ratings. This kind of tooling costs money, which NVD doesn’t have much of, and the outputs aren’t entirely trustworthy. The NVD is looking for input from the public – which really means experts who don’t work in the federal government – on how they should be spending their time and energy on NVD continuing doing NVD things.
But what if we didn’t? #
Notably, this RFI is a fine way for you to tell NVD if they should be continuing this enrichment program at all. After all, with the admitted and obvious degradation of NVD-based enrichment back in February of 2024, CISA picked up the ball in January of 2025 with the launch of the Vulnrichment program, which does most of the same kind of enrichment on CVE data – and I say “most” because pretty soon after launch, CISA found that accurately inventing CPEs is actually really, really hard, and something that the NVD is uniquely qualified to do.
But then again, CISA faced its own funding scare, so maybe having two federal agencies on this enrichment task, one in DHS, the other in the Department of Commerce, is a good hedge against future funding kerfuffles? You might believe this is all needless duplication and waste, whereas I might say that redundancy is a virtue when it comes to systems design. It’s complicated!
In the end, if you’re the sort to have read this far, my guess is that NVD needs your input. This RFI is unusually expansive, covering a lot of technical ground, and almost nobody has expertise in all the areas discussed. If you have informed opinions on even one or two of these areas, let NIST know before the RFI closes on October 13, 2026.
