Loading story…
The cybersecurity industry is facing significant challenges in vulnerability management, particularly in the areas of exposure management and the handling of Common Vulnerabilities and Exposures (CVE) data. Recent analysis highlights the evolving landscape of exposure management, with a shift toward Continuous Threat Exposure Management (CTEM) and the use of real-world metrics to assess organizational risk, especially among small and medium-sized businesses (SMBs) that often lack the resources of larger enterprises. The concept of the cybersecurity poverty line underscores the disparity in security capabilities, even as threats remain consistent across organizations of all sizes.
Simultaneously, the process of tracking and enriching CVE data has come under scrutiny due to operational and funding challenges. The National Vulnerability Database (NVD), managed by NIST, experienced a significant backlog in CVE processing after a funding shortfall, revealing the risks of relying on a single, government-funded point of failure for global vulnerability data. Experts are now calling for a decentralized, global approach to CVE data management to ensure timely enrichment and analysis, as only a fraction of assigned CVE identifiers are currently fully processed. These issues highlight the urgent need for innovation and investment in both exposure management practices and the infrastructure supporting vulnerability intelligence.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
NIST said it will stop automatically enriching every submitted CVE in the National Vulnerability Database and instead prioritize higher-risk vulnerabilities, including those in CISA’s KEV catalog and software relevant to the federal government. The change was attributed to a sharp rise in CVE submissions that outpaced NIST’s capacity, prompting concerns from security experts about reduced visibility into lower-priority flaws.
Initial story creation
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
17 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourceresilientcyber.io
Open sourcepulse.latio.tech
Open sourcecybersecuritynews.com
Open sourcelinkedin.com
Open sourcesdxcentral.com
Open sourceresilientcyber.io
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**NIST is reevaluating its role in analyzing and “enriching” vulnerabilities in the National Vulnerability Database (NVD)** as demand for vulnerability analysis continues to outpace the agency’s capacity. NIST leadership told the Information Security and Privacy Advisory Board that the enrichment process is *labor-intensive* and “not scalable” given the volume of incoming CVEs, prompting a strategic review and a shift toward **prioritizing/triaging** which vulnerabilities receive deeper analysis. The broader ecosystem is also seeing parallel efforts to improve vulnerability correlation and disclosure workflows outside of any single identifier system. *Vulnerability-Lookup* is positioned as a sharing and correlation platform that aggregates vulnerability information from multiple sources, supports sightings (e.g., *seen*, *exploited*, *patched*), and is designed to operate independently of specific vulnerability IDs while remaining compatible with the **Global CVE Allocation System (GCVE)**—highlighting how tooling and processes are evolving as stakeholders question scalability and governance of centralized vulnerability analysis.
Jul 12, 2026
Security leaders and practitioners are re-evaluating traditional vulnerability management practices as the volume and complexity of threats outpace the capabilities of legacy systems. The near-shutdown of the CVE program highlighted the risks of relying solely on public vulnerability disclosures, as many real-world threats stem from misconfigurations and exposures not tracked by CVEs. Industry experts emphasize the need for a unified, risk-based approach that prioritizes exposures most likely to impact business operations, rather than attempting to address every alert or vulnerability. Continuous Threat Exposure Management (CTEM) and similar frameworks are gaining traction, focusing on validating and prioritizing the handful of exposures that truly matter to organizational resilience.
Jul 23, 2026
Organizations are facing an overwhelming volume of software vulnerabilities, with over 40,000 new CVEs published in 2024 alone, making traditional vulnerability management approaches unsustainable. This has led to a shift toward exposure management, which focuses on reducing the active attack surface rather than simply closing vulnerability tickets. Exposure management platforms, such as Spektion, employ advanced techniques like behavioral monitoring and pre-CVE detection to identify and prioritize risks based on real-world exploitability, including the discovery of shadow IT and actively loaded vulnerabilities. To support effective prioritization, the Common Vulnerability Scoring System (CVSS) provides a standardized framework for assessing and communicating the severity of vulnerabilities. The latest version, CVSS v4.0, introduces expanded metric groups and more granular scoring, enabling organizations to better compare vulnerabilities, prioritize mitigation efforts, and communicate risk to stakeholders. Together, these developments in exposure management platforms and vulnerability scoring systems are helping security teams move beyond the "CVE treadmill" and focus resources on the most critical threats.
Jun 29, 2026