Topic starter
02/08/2026 11:45 am
TL;DR: Vulnerability coverage now depends on multiple sources, according to Aikido, after NIST’s shift to a risk-based CVE approach followed backlog growth and gaps in enrichment, scoring, and downstream detection. Vulnerability workflows need independent validation or they can undercount exposure and mislead prioritisation.
Editorial analysis by NHI Mgmt Group, based on content published by Aikido: “Reliable CVE sources in the age of NIST NVD cutbacks”.
By the numbers:
- By mid-2024, 75% of submitted CVEs were unprocessed in NVD, according to Aikido.
- In 2025, CVE submissions increased by 263%, according to Aikido.
- In 2025, CVEs enriched by NVD increased by 45%, according to Aikido.
Key questions
Q: Why do false negatives increase when organisations rely on one CVE source?
A: False negatives increase because no single database sees every disclosed or undisclosed issue, and enrichment backlogs further delay what does get submitted.
Q: How do security teams know whether vulnerability assessment is actually working?
A: Teams should look for short triage cycles, high-confidence findings, and a clear link between scan results and remediation action.
Q: What breaks when NVD enrichment is incomplete?
A: When NVD enrichment is incomplete, scanners, prioritisation engines, and reporting workflows can miss or delay real vulnerabilities.
Practitioner guidance
- Diversify vulnerability intake sources Combine NVD with vendor advisories, GitHub Advisory, KEV, release notes, and commit-level monitoring so a missing enrichment record does not suppress detection.
- Audit scanner suppression paths Test whether your detection tools fail open, fail closed, or silently downgrade findings when a CVE lacks NVD enrichment or a CPE mapping.
- Track unlisted vulnerability signals Measure how many issues first appear in changelogs, patches, or internal telemetry before they show up in a public CVE database.
Bottom line: NVD cutbacks show that vulnerability management can no longer rely on a single enriched database to provide complete coverage.
Glossary terms: CVE Enrichment, False negative, Vulnerability Intelligence
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
02/08/2026 12:56 pm
CVE enrichment has become a prioritisation layer, not a completeness layer: the old assumption was that a central database would eventually tell security teams what mattered. That assumption no longer holds when submission volume, backlog, and selective analysis all degrade coverage. For vulnerability governance, the control question has shifted from whether a CVE exists to whether the organisation has independent ways to detect unlisted exposure. Practitioners should stop treating one feed as authoritative.
A question worth separating out:
Q: When should organisations stop treating NVD as the source of truth?
A: They should stop treating NVD as the source of truth now, because backlog, selective enrichment, and undisclosed fixes all create blind spots that one feed cannot solve. NVD remains useful, but it should be one input in a federated model. The governance shift is from dependence on a central record to evidence-based verification across several sources.
👉 Read our full editorial: NVD cutbacks show why CVE enrichment is no longer enough