Executive Summary
The Common Vulnerabilities and Exposures (CVE) ecosystem has outgrown the third-party enrichment role the National Vulnerability Database (NVD) was built to play. The central problem is not processing capacity, and AI-enabled automation will not solve it. It is the absence of accountability for the quality of CVE records at the point they are created.
The same classes of software defect have dominated for two decades. In the review of fiscal years 2024 and 2025 by the Cybersecurity and Infrastructure Security Agency (CISA), about 40 percent of entries in the Known Exploited Vulnerabilities Catalog mapped to weaknesses the industry has tracked for years, and 31 percent of breaches now begin with vulnerability exploitation. These defects persist because software manufacturers face no meaningful liability for shipping them. The same gap extends to the records that describe them: CVE Numbering Authorities (CNAs), now more than 550 and including most major manufacturers, are not required to publish complete, accurate, and timely records, and face no consequence when they do not. NVD’s enrichment function absorbs that gap by repairing records after the fact, which masks the failure and weakens the incentive to fix it upstream. AI-accelerated discovery increases record volume and makes the repair model less sustainable, not more.
We therefore recommend four structural changes, offered as substitutions for current NVD activity rather than additions to it:
First, the National Institute of Standards and Technology (NIST) should sunset NVD’s record-level enrichment function and, working with Congress, transfer the NVD enrichment budget to CISA.
Second, NIST should set explicit CAT standards (complete, accurate, timely) for what a CVE record must contain at CNA creation, and formalize a provenanced attribute data model for severity and exploitability claims.
Third, CISA should operate per-CNA measurement against those standards and publish the results, so that record quality becomes visible to manufacturers, operators, and buyers. NIST and CISA should also refocus the Common Weakness Enumeration (CWE) taxonomy so that the same measurement shows which software manufacturers are eliminating recurring classes of defect.
Fourth, NIST should retire centralized Common Platform Enumeration (CPE) maintenance and transfer product and supplier identification to first-party CNAs.
We do not recommend adding new capabilities to NVD, AI-enabled or otherwise.
Beyond the NVD, we urge NIST to set secure-by-design software expectations for AI code generation in its secure development guidance, most directly Special Publication (SP) 800-218A: AI corporations should test their models against known-unsafe coding patterns before release, publish defect rates in generated code, and tune their models to refuse known-dangerous patterns where possible.
