Notifications
Clear all
Topic starter
11/08/2026 3:19 pm
TL;DR: NIST will prioritize CVE enrichment around KEV, federal software, and Executive Order 14028 critical software, leaving lower-priority vulnerabilities with less immediate analysis as CVE volume continues to outpace manual review, according to Bishop Fox. Risk-based triage is now a governance requirement, not a maturity preference, because defenders cannot rely on uniform enrichment to separate signal from noise.
NHIMG editorial — based on content published by Bishop Fox: NIST is changing how it prioritises CVE enrichment for deeper analysis
By the numbers:
- NIST has previously reported that CVE submissions more than tripled, with 263% growth between 2020 and 2025.
- In 2024, 40,077 new CVEs were issued, and another 48,244 followed in 2025.
- NIST enrichment grew steadily through 2023, peaked in 2024 at 29,817 CVEs, then fell to 25,453 in 2025.
Questions worth separating out
Q: How should security teams prioritise vulnerabilities when CVE metadata is incomplete?
A: Prioritise by runtime exposure, exploitability, and reachability, not by CVE presence alone.
Q: Why does DNS redundancy matter for identity and access programmes?
A: DNS underpins service reachability for SSO, authentication endpoints, SaaS access, and workload connectivity.
Q: What do security teams get wrong about severity-based patching?
A: They often assume a high score means equal urgency everywhere.
Practitioner guidance
- Build a risk-based patch queue Rank vulnerabilities by reachability, authentication requirements, exposed privilege paths, and asset criticality, then patch in that order rather than by score alone.
- Create internal enrichment substitutes Maintain your own context for internet exposure, ownership, business criticality, and privileged dependencies so you can triage even when NVD metadata is incomplete.
- Re-check identity-adjacent systems first Prioritise services that front secrets managers, SSO, CI/CD, or administrative consoles because unpatched flaws there can turn into credential theft or access escalation.
What's in the full article
Bishop Fox's full post covers the operational detail this post intentionally leaves for the source:
- The CVE, CNA, and NVD process breakdown that explains where enrichment now sits in the pipeline
- The chart methodology used to compare reserved, published, and enriched CVE counts across years
- The specific triage questions Bishop Fox recommends for deciding which vulnerabilities rise to the top
- The discussion of CISA Vulnrichment and the NVD 2.0 API, which matters for downstream tooling migration
👉 Read Bishop Fox's analysis of NIST's CVE enrichment prioritisation shift →
NIST CVE enrichment changes: what does it mean for triage teams?
Explore further
11/08/2026 3:31 pm
Risk-based triage has become the only scalable vulnerability governance model. When CVE volume grows faster than enrichment capacity, defenders cannot wait for perfect external context before making patch decisions. The article shows that prioritisation is no longer an optimisation exercise but an operational necessity. Teams need their own exposure model because external feeds will not carry the whole burden.
A question worth separating out:
Q: Who is accountable when delayed enrichment causes a missed remediation window?
A: Accountability sits with the programme owner, not the metadata source. Teams must define who owns triage, who resolves conflicts, and who can override automation when enrichment is missing. Governance frameworks should treat delayed context as an operational risk that requires explicit decision ownership.
👉 Read our full editorial: NIST’s CVE enrichment shift makes risk-based triage mandatory
