TL;DR: NIST’s shift to a risk-based CVE approach comes after backlog growth left many submissions unprocessed, creating gaps in enrichment, scoring, and downstream detection for teams that treat NVD as a source of truth, according to Aikido. The practical result is that vulnerability coverage now depends on multiple sources, not a single database.
At a glance
What this is: Aikido argues that NVD cutbacks have turned CVE enrichment from a dependable control into an increasingly incomplete signal for vulnerability management.
Why it matters: This matters because teams that treat NVD as a source of truth can miss exposed software, undercount risk, and build automation on false negatives instead of verified coverage.
By the numbers:
- By mid-2024, 75% of submitted CVEs were unprocessed in NVD, according to Aikido.
- In 2025, CVE submissions increased by 263%, according to Aikido.
- In 2025, CVEs enriched by NVD increased by 45%, according to Aikido.
- Aikido says Intel found vulnerabilities in packages where 67% were never publicly disclosed to any database in its first year.
Context
NVD enrichment is a governance control as much as a data source. When enrichment slows, scoring, prioritisation, and downstream alerting all inherit the same blind spot, which is why reliance on a single vulnerability database now creates operational risk rather than reducing it. The article’s core point is that CVE coverage is no longer complete enough to treat as a sole source of truth.
That shift matters for vulnerability management programmes, but it also has an identity angle through software supply chain access and API-driven tooling that depends on catalogued disclosures. If a record is missing or delayed, the control failure is not just incomplete inventory but delayed decision-making across scanning, patching, and risk acceptance. Teams that assume centralised enrichment equals completeness are now operating on an outdated model.
Key questions
Q: What breaks when NVD enrichment is incomplete?
A: When NVD enrichment is incomplete, scanners, prioritisation engines, and reporting workflows can miss or delay real vulnerabilities. The practical failure is not just slower metadata. It is silent undercoverage, where teams believe a weakness does not exist because their primary source did not yet process it. That creates false negatives in remediation and risk acceptance decisions.
Q: Why do false negatives increase when organisations rely on one CVE source?
A: False negatives increase because no single database sees every disclosed or undisclosed issue, and enrichment backlogs further delay what does get submitted. If your tooling inherits that dependency, missing records become missing alerts. The result is a narrower view of exposure than your programme assumes, especially in fast-moving open-source ecosystems.
Q: How do security teams know whether vulnerability assessment is actually working?
A: Teams should look for short triage cycles, high-confidence findings, and a clear link between scan results and remediation action. A working programme reduces uncertainty around what to fix first. If the same issues keep reappearing or the queue is dominated by false alarms, the tool is not helping governance.
Q: When should organisations stop treating NVD as the source of truth?
A: They should stop treating NVD as the source of truth now, because backlog, selective enrichment, and undisclosed fixes all create blind spots that one feed cannot solve. NVD remains useful, but it should be one input in a federated model. The governance shift is from dependence on a central record to evidence-based verification across several sources.
Technical breakdown
Why NVD enrichment no longer guarantees complete coverage
NVD enrichment is the process of adding analysis, scoring, and metadata to a submitted CVE so tools can consume a standardised vulnerability record. That model breaks when submission volume outpaces analyst throughput, because unprocessed records remain less useful for downstream tooling and prioritisation. In practice, this creates a data-plane problem: the vulnerability may exist, but the signal that most products depend on is delayed, incomplete, or absent. Risk-based triage helps the database cope, but it also means some CVEs will not receive the same level of independent review.
Practical implication: Treat NVD as one input to vulnerability intelligence, not the completeness guarantee for your detection stack.
How false negatives emerge in scanner and prioritisation pipelines
A false negative appears when a tool fails to alert on a weakness because the upstream record was not enriched, not mapped, or not yet ingested. That failure is especially damaging in asset discovery and prioritisation workflows, where teams expect their scanners to surface what matters most. If the backend depends on NVD enrichment, the tool may miss a relevant issue even though the software is already patched publicly or quietly vulnerable. The technical issue is not just delay. It is that the pipeline equates enrichment completeness with security reality, which is no longer valid.
Practical implication: Validate scanner coverage against additional sources and test whether missing enrichment suppresses alerts or only delays them.
Why disclosure coverage is broader than CVE coverage
CVE databases only cover vulnerabilities that get disclosed, but many maintainers patch issues without public reporting. That means even a perfectly staffed enrichment system would still miss a large share of real-world risk if the underlying disclosure never arrives. The article’s examples show the structural gap clearly: security-relevant fixes can appear in changelogs, release notes, or commits long before any database record exists. This is why automated intelligence increasingly has to read source artifacts directly, then reconcile them against multiple databases instead of assuming a single canonical feed.
Practical implication: Build a second discovery path from release notes, changelogs, and commits to catch vulnerabilities that never become CVEs.
NHI Mgmt Group analysis
CVE enrichment has become a prioritisation layer, not a completeness layer: the old assumption was that a central database would eventually tell security teams what mattered. That assumption no longer holds when submission volume, backlog, and selective analysis all degrade coverage. For vulnerability governance, the control question has shifted from whether a CVE exists to whether the organisation has independent ways to detect unlisted exposure. Practitioners should stop treating one feed as authoritative.
False negatives are now a programme design problem, not a tool bug: when scanners inherit the incompleteness of upstream enrichment, the failure propagates into patching SLAs, exception handling, and board reporting. This creates the kind of blind spot that makes risk acceptance look safer than it is. Teams need to redesign coverage assumptions around multi-source validation, not wait for a single database to catch up. That is the practical lesson of the NVD backlog.
Source-of-truth dependency is the real vulnerability management debt: the named concept here is dependency on a single vulnerability source of truth. It sounds efficient until the source becomes selective, delayed, or politically constrained. The better model is federated vulnerability intelligence, where NVD is one signal among several and internal validation closes the gap. Practitioners should measure decision latency, not just scan counts, to see whether the programme still sees reality in time.
What this signals
Source-of-truth fragility: vulnerability management programmes should expect authoritative feeds to become selective under load, which means detection quality has to be validated independently of any single database. That changes the governance standard from completeness by assumption to completeness by evidence.
Multi-source verification is now the baseline: teams need to correlate vendor advisories, public disclosures, and internal telemetry before accepting that exposure has been fully assessed. The operational question is no longer whether the database is current enough, but whether the programme can survive when it is not.
For practitioners
- Diversify vulnerability intake sources Combine NVD with vendor advisories, GitHub Advisory, KEV, release notes, and commit-level monitoring so a missing enrichment record does not suppress detection.
- Audit scanner suppression paths Test whether your detection tools fail open, fail closed, or silently downgrade findings when a CVE lacks NVD enrichment or a CPE mapping.
- Track unlisted vulnerability signals Measure how many issues first appear in changelogs, patches, or internal telemetry before they show up in a public CVE database.
- Rework risk acceptance criteria Base remediation decisions on corroborated exposure evidence, not on the presence or absence of a single database entry.
Key takeaways
- NVD cutbacks show that vulnerability management can no longer rely on a single enriched database to provide complete coverage.
- Backlog growth and selective analysis create false negatives that can suppress alerts, distort prioritisation, and weaken reporting.
- Security teams now need federated vulnerability intelligence, with independent validation from release notes, advisories, and other disclosure sources.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.RA-01 — Asset vulnerabilities are identified and recorded | The article is about incomplete vulnerability identification and coverage gaps. |
| Recommendation — Cross-check vulnerability sources so recorded exposure does not depend on one incomplete feed. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | The article focuses on continuous vulnerability tracking under delayed enrichment conditions. |
| Recommendation — Use continuous vulnerability monitoring that validates findings across multiple disclosure sources. | ||
| MITRE ATT&CK | TA0007 — Discovery | Delayed or missing vulnerability records weaken defenders' discovery of exposed software. |
| Recommendation — Map missing enrichment to Discovery gaps and hunt for exposures your primary feed has not surfaced. | ||
Key terms
- CVE Enrichment: CVE enrichment is the process of adding severity, product mapping, and contextual data to a vulnerability record. It turns a bare identifier into an operational signal that scanners, dashboards, and triage workflows can use to decide what to fix first and where the risk sits.
- False negative: A missed detection where a real threat is not recognised as malicious or important. In AI SOC environments, false negatives often arise when the system under-collects context, stops at the first plausible answer, or over-optimises for speed.
- Vulnerability Intelligence: Vulnerability intelligence is the information used to identify, prioritise, and remediate software flaws across an environment. It includes identifiers, severity data, advisories, and affected-product details that feed patching and risk workflows.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.
Published by the NHIMG editorial team on August 2, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org