Blog
Managing the National Vulnerability Database (NVD) Issue: Solutions for Improved Vulnerability Management
5 min read
Recent reports have revealed a significant issue with the National Vulnerability Database (NVD) that may impact your vulnerability management activities. The NVD is a widely recognized and longstanding vulnerability database that is used by countless security tools and codified into various regulations and requirements. However, researchers and practitioners have raised concerns about the lack of transparency and communication from NIST and the NVD about a recent announcement to form a consortium to address challenges in the NVD program and develop improved tools and methods.
The Challenge
NIST NVD has approximately 20 analysts analyzing and enriching CVE data with CPE (Common Platform Enumerations), CWE (Common Weakness Enumeration) and CVSS (Common Vulnerability Scoring System) scores. NVD has opted to pause analysis and enrichment of CVE's as of February 12, 2024 while they put together a consortium "to address challenges in the NVD program and develop improved tools and methods". Does this mean even NVD is overwhelmed with the sheer volume of vulnerabilities? The root cause of the NVD backlog is uncertain- but its plausible.
The potential impact of this problem is significant, as many organizations rely on the NVD for their vulnerability management activities. Without accurate and up-to-date information from the NVD, organizations may not be able to effectively identify and address vulnerabilities in their systems, which could leave them at risk of cyber attacks.
The Solution
In light of this issue with the NVD, we are taking up arms to improve the accuracy and completeness of CPE names by collaborating with other stakeholders in the vulnerability management community, leveraging our unique expertise in AI and Cybersecurity.
Our RiskHorizon CORE, a Cyber-Optimized Research Engine comprised of multimodal AI models, allows us to train on CPE data from the NVD. Our AI learns the NVD CPE naming convention, and reads through source vendor advisories in real-time and at scale, converting them to machine-readable format output. This output conforms to the NVD's CPE 2.3 requirements. This allows us to augment the NVD's analysis process and provide the CPE enrichment data bypassing the NVD backlog.
We welcome the opportunity to show off the true power of the RiskHorizon's CORE. We assimilate both structured and unstructured data from thousands of sources across the deep and dark web, and convert into a unified source of truth on exploit intelligence, vulnerability intelligence, and threat actor intelligence. This allows our community to stay operational, capturing relevant information on ransomware, threat actors, malware, proof of concepts, in a central source of truth that traditional vendors simply cannot match. We have no single points of failure.
With our AI-native continuous threat exposure management (#CTEM) solution, we can provide our community with a comprehensive view of the evolving threat landscape and enable them to make informed decisions about their security posture 24/7 - uninterrupted. Don't settle for a single source of vulnerability data. Choose a vendor that provides a comprehensive view of the threat landscape with continuous threat exposure management pulling from thousands of sources in real-time to give you the most complete view of the evolving threat landscape mapped to your risk posture.
Blog
