Sign Up for Our Newsletter
Donate

Archive

vulnerability management

CVE at a Crossroads: A Blueprint for the Next 25 Years

Report

CVE at a Crossroads: A Blueprint for the Next 25 Years

The Common Vulnerabilities and Exposures (CVE) Program is a critical public good, yet it is at a crossroads. Established by MITRE with support from the U.S. government, the index of software vulnerability identifiers has been a core element of software security since 1999. But recent funding issues have laid bare fundamental challenges, and without action, the vulnerability identification landscape will fragment. This report provides recommendations for global policymakers on how to reimagine the CVE Program for the next 25 years.
Common Vulnerabilities and Exposures, CVE, Global Vulnerability Catalog, National Vulnerability Management Program, software, vulnerability identification, vulnerability management
October 8, 2025
What should CVE be when it grows up?

Event

August 5, 2025 1:00 pm

What should CVE be when it grows up?

At Security BSides Las Vegas, IST Senior VP Bob Lord moderated a panel on the future of the CVE program. What are the challenges it faces? What governance models should be considered?
CISA, CVE, Hacker Summer Camp, vulnerability management
August 5, 2025
Castles Built on Sand: Digging into the Foundation | Towards Securing the Open-Source Software Ecosystem

Event

July 18, 2023 3:00 pm

Castles Built on Sand: Digging into the Foundation | Towards Securing the Open-Source Software Ecosystem

On July 18, 2023 Politico’s John Sakellariadis moderated a conversation with the authors of Castles Built on Sand to dig into the foundation of our recommendations to secure the open-source software ecosystem.
Log4j, open source software, software security, vulnerability management
July 18, 2023
Castles Built on Sand: Towards Securing the Open-Source Software Ecosystem

Report

Castles Built on Sand: Towards Securing the Open-Source Software Ecosystem

Castles Built on Sand advocates for a fundamental shift in the open-source software ecosystem. Taking the Log4j vulnerability as a case study, the paper seeks to understand the documentation of its development, the transparent response and mitigation efforts at each stage of the disclosure cycle, and its ongoing exploitation.
cybersecurity, Log4j, open source software, vulnerability management
April 17, 2023
A Most Dangerous Precedent

Blog

A Most Dangerous Precedent

As digital authoritarian regimes rise across the globe, the internet has increasingly turned towards balkanization, isolating citizens within digital borders.
China, cybersecurity, digital authoritarianism, vulnerability management, zero days
July 19, 2021