Notifications
Clear all
Topic starter
02/08/2026 11:57 am
TL;DR: NIST’s move to end enrichment for most open source vulnerabilities leaves nearly 300,000 backlogged CVEs in “Not Scheduled,” weakening the severity and version data that many SCA tools use for prioritisation, according to Semgrep. The shift makes reachability, KEV, and independently validated metadata central to defensible vulnerability management.
NHIMG editorial — based on content published by Semgrep: analysis of the NVD enrichment changes and their impact on vulnerability management
Questions worth separating out
Q: What breaks when vulnerability enrichment becomes delayed or selective?
A: Prioritisation breaks first.
Q: Why should teams use reachability instead of raw CVSS alone?
A: Raw CVSS measures theoretical severity, not whether the vulnerable code can actually be invoked in your application.
Q: What do security teams get wrong about central vulnerability databases?
A: They often treat the database score as an objective fact rather than one input in a broader decision process.
Practitioner guidance
- Audit vulnerability policy language Review FedRAMP, PCI DSS, cyber insurance, and customer questionnaire language that treats NVD CVSS as the sole source of truth.
- Move to multi-signal prioritisation Adopt KEV, EPSS, and reachability together so remediation decisions do not depend on a single upstream score.
- Interrogate SCA data sources Ask vendors whether their scores are CNA-assigned or independently calculated, and whether their reachability analysis stops at dependency, function, or dataflow level.
What's in the full article
Semgrep's full article covers the operational detail this post intentionally leaves for the source:
- How Semgrep Supply Chain uses reachability to reduce SCA noise across dependency, function, and dataflow analysis
- Why the team chose GitHub Security Advisories over NVD as a source of truth for prioritisation
- What to change in compliance language when NVD CVSS is no longer a dependable authority
- How practitioners should question vendor data provenance after the NVD enrichment shift
👉 Read Semgrep's analysis of the NVD enrichment changes and SCA prioritisation →
NVD enrichment changes: what it means for SCA and prioritisation?
Explore further
02/08/2026 1:05 pm
Security programmes are moving from enrichment dependence to evidence dependence. When the public vulnerability pipeline stops providing complete severity and version data, teams can no longer assume that a CVE record is operationally meaningful on its own. The real control becomes whether the organisation can corroborate exploitability through reachability, asset context, and threat intelligence. That shifts vulnerability management from catalogue consumption to evidence synthesis.
A question worth separating out:
Q: How should organisations decide what to patch first after disclosure backlogs grow?
A: Use a layered model that starts with known exploitation, then checks exposure and reachability, then applies business criticality. This avoids overreacting to every CVE while still elevating issues that are actually reachable in production. The goal is defensible prioritisation, not perfect completeness.
👉 Read our full editorial: NVD enrichment changes expose the limits of CVE prioritization
