Topic starter
02/08/2026 11:45 am
TL;DR: NIST’s shift to a risk-based CVE approach comes after backlog growth left many submissions unprocessed, creating gaps in enrichment, scoring, and downstream detection for teams that treat NVD as a source of truth, according to Aikido. The practical result is that vulnerability coverage now depends on multiple sources, not a single database.
Editorial analysis by NHI Mgmt Group, based on content published by Aikido: “Reliable CVE sources in the age of NIST NVD cutbacks”.
By the numbers:
- By mid-2024, 75% of submitted CVEs were unprocessed in NVD, according to Aikido.
- In 2025, CVE submissions increased by 263%, according to Aikido.
- In 2025, CVEs enriched by NVD increased by 45%, according to Aikido.
Key questions
Q: What breaks when NVD enrichment is incomplete?
A: When NVD enrichment is incomplete, scanners, prioritisation engines, and reporting workflows can miss or delay real vulnerabilities.
Q: Why do false negatives increase when organisations rely on one CVE source?
A: False negatives increase because no single database sees every disclosed or undisclosed issue, and enrichment backlogs further delay what does get submitted.
Q: How do security teams know whether vulnerability assessment is actually working?
A: Teams should look for short triage cycles, high-confidence findings, and a clear link between scan results and remediation action.
Practitioner guidance
- Diversify vulnerability intake sources Combine NVD with vendor advisories, GitHub Advisory, KEV, release notes, and commit-level monitoring so a missing enrichment record does not suppress detection.
- Audit scanner suppression paths Test whether your detection tools fail open, fail closed, or silently downgrade findings when a CVE lacks NVD enrichment or a CPE mapping.
- Track unlisted vulnerability signals Measure how many issues first appear in changelogs, patches, or internal telemetry before they show up in a public CVE database.
Bottom line: NVD cutbacks show that vulnerability management can no longer rely on a single enriched database to provide complete coverage.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:56 pm
CVE enrichment has become a prioritisation layer, not a completeness layer: the old assumption was that a central database would eventually tell security teams what mattered. That assumption no longer holds when submission volume, backlog, and selective analysis all degrade coverage. For vulnerability governance, the control question has shifted from whether a CVE exists to whether the organisation has independent ways to detect unlisted exposure. Practitioners should stop treating one feed as authoritative.
A question worth separating out:
Q: When should organisations stop treating NVD as the source of truth?
A: They should stop treating NVD as the source of truth now, because backlog, selective enrichment, and undisclosed fixes all create blind spots that one feed cannot solve. NVD remains useful, but it should be one input in a federated model. The governance shift is from dependence on a central record to evidence-based verification across several sources.
👉 Read our full editorial: NVD cutbacks show why CVE enrichment is no longer enough