From Roadmap to Results: Measuring CWE Adoption to Enable Prevention
summary
CWE reports measurable adoption: a public REST API and 75 new weakness diagrams support automation, the community-driven CDR has 191 submissions (102 still active) improving entry depth, and monthly hardware SIG work expands scope into silicon. CNA mappings grow in number and quality—discouraged mappings shrink (about half the 2024 slice) and analyses cover ~50k mappings across ~500 CWEs—backed by mapping labels (allowed with review, discouraged/prohibited) and ML-assisted suggestions that drive concrete mapping corrections.
AI-written summary · about
chapters (10)
- 0:00CWE introduction and mission
- 3:11What is CWE
- 6:23CWE adoption plan
- 12:01CWE adoption impact
- 18:37CWE content improvements
- 27:32Weakness vs vulnerability mindset
- 38:08CWE mapping errors
- 47:19Community engagement
- 51:27CWE progress summary
- 53:34Q&A
related talks
57mThe CWE Program: Current State and Road Ahead
59mHard Problems in CWE, and What it Tells us about Hard Problems in the Industry
28mHow Do We Leverage CVE Root Cause Mapping and CWE Data to Prevent New Vulnerabilities?
53mPanel Discussion: Enabling Accurate, Decentralized Root Cause Mapping at Scale
57mVulnerability Root Cause Mapping with CWE
01h 00mCVE Records: The Cybersecurity Glow-Up You Didn’t Know You Needed
15mCVE vs CWE: From Patch Fixes to Eradicating Root Causes
56mCISA’s North Star Vision for the CVE Program