Where Do We Aim? A Look at the State of Vulnerable Software Identification and Its Future
summary
CPE remains the NVD-maintained dictionary for product-level mapping while Pearl targets package distribution points and downstream rebundles, and both support version ranges imperfectly; CISA supplies most CPE entries but stops adding CPE on Dec 10, 2024, leaving a hole as CVE submissions grow ~32% in 2025 and projections expect ~15% more CDEs; recommendation is for CNAs/software producers to publish machine-readable CPE/Pearl and SBOM data (use SCA tools, SWID, vulnerogram APIs) so enrichment programs aren’t the single point of truth.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:27Software identification schemes
- 6:27CPE versus Pearl methods
- 10:41CPE data gaps analysis
- 13:12Software producers as sources
- 15:21Improving MITER, CISA, NVD
- 17:50Call to action
- 18:52Q&A
related talks
35mVulnrichment Playground
33mCVE Decaf: Brewing Better and More Actionable Data Quality
41mNIST’s National Vulnerability Database Update and the Vulnerability Enrichment Ecosystem
37mGoverning Global Vulnerabilities: Standards for Open Source Resilience
30mThe Growing Crisis in CVE Data Quality
01h 00mThe CVE Program Quality Era: Strengthening Trust and Impact In Global Vulnerability Data
57mThe CWE Program: Current State and Road Ahead
56mCVE Is The Worst Vulnerability Framework (Except For All The Others)