CISA’s North Star Vision for the CVE Program
summary
CISA lays out a practical North Star: scale federation to get from completeness to quality, add operational enrichments like SSVC into CVE records, and push vendors to own CVE IDs. Panelists show dashboards and predict ~330,000 CVEs in 2025 while reporting 90% product/vendor fields and ~85% CWE/CVSS fill rates from CNAs. Work under way includes automation, root‑cause mapping using CWE (largest is CWE 79 (XSS)), commercial CNA onboarding, an enrichment standard and an open survey for community feedback.
AI-written summary · about
chapters (6)
- 0:00CISA’s CVE program vision
- 2:34CVE challenges and opportunities
- 16:26Predicting CVE growth needs
- 24:07North Star for CVE scaling
- 37:04Measuring CVE record completeness
- 50:05Improving CVE quality feedback
related talks
01h 00mThe CVE Program Quality Era: Strengthening Trust and Impact In Global Vulnerability Data
37mGoverning Global Vulnerabilities: Standards for Open Source Resilience
45mFuture of CVE
01h 05mWhat It Takes to Lead America’s Vulnerability Management Team
30mThe Growing Crisis in CVE Data Quality
48mCISA-ENISA Joint Messaging
29mThe Quality Era of CVE: A Blueprint for Global Software Safety
53mCNA Feedback Session to the CVE Program