NIST Shifts CVE Enrichment Strategy (risky.biz)

• NIST prioritizes high-impact CVE enrichment
• Shift from comprehensive manual review to risk-based filtering
• Increased enterprise reliance on commercial vulnerability data

"The U.S. National Institute of Standards and Technology (NIST) has curtailed its effort to manually enrich Common Vulnerabilities and Exposures (CVEs). Facing a massive backlog, the agency is prioritizing high-impact vulnerabilities while delegating the analysis of lower-severity issues. This shift acknowledges the limits of public sector scaling against the explosion of software vulnerabilities. The move creates a dependency shift, as industry reliance on the National Vulnerability Database (NVD) for automated security patching may now require private commercial tools to fill the gap in vulnerability metadata, potentially impacting enterprise risk management across the Atlantic."