Shaping the NVD for the Future: We Need Your Feedback on AI-Enabled Vulnerability Management

New Opportunities for the NVD via Automation

Our cybersecurity landscape is changing dramatically and is being reconfigured by artificial intelligence (AI) in unique, exciting, and yes, sometimes challenging ways. This is creating openings to potentially leverage AI systems to discover and exploit vulnerabilities — but AI can also serve as a valuable tool to strengthen cybersecurity and speed up response times. As the volume of reported vulnerabilities surges and emerging technologies reshape the threat picture, it is time for traditional vulnerability management practices centered on periodic patching and manual remediation to be transformed toward continuous, automated, and contextual vulnerability management.

With the rapid growth of AI-enabled cyber tools and dramatically accelerated technology delivery cycles, NIST aims to improve the NVD’s scalability, automation, interoperability, transparency, and utility — modernizing it for the future. To guide this transformation, NIST released a Request for Information (RFI) and is seeking feedback, especially from technical experts, industry and government leaders, researchers, cybersecurity professionals, and software vendors. This is an “all hands-on deck” moment for this community. 

Your voice matters. We want to understand your priorities and challenges and to learn about opportunities you see to improve vulnerability management. We are committed to providing you with the information and tools you need to anticipate and deal with software vulnerabilities.

Steps We’ve Already Taken

We have already begun work on a tool, called V-etalon, that leverages AI technologies to aid in enriching vulnerability information. We hope that V-etalon will eventually provide a foundation for the evaluation of vulnerability information. We will be looking for feedback and collaboration opportunities once it’s available, all via GitHub (please stay tuned for an upcoming release and announcement).

Additionally, NIST has kicked off work to update the Common Platform Enumeration (CPE) specifications, a mechanism for describing vulnerable products to better apply to hardware and to improve the specifications based on learning from over a decade of use. NIST held a workshop in June to share initial directions and gather feedback. 

See the CPE page for more information.

Collaboration is Key

We need input from across the community to ensure this ecosystem is effective, scalable, and resilient in the face of emerging threats.

NIST plays a key role in this ecosystem, which relies on many other organizations and individuals (including those who identify, evaluate, provide, and implement solutions to manage cybersecurity risks). NIST intends to support a future-ready vulnerability management ecosystem that is continuous, contextual, and automated into the future.

What Key Feedback Areas Would be Most Helpful to NIST?

• Vulnerability Management Process
• Vulnerability Information Dissemination
• Risk Assessment and Prioritization
• Remediation Development, Deployment, and Monitoring
• Vulnerability Data and Standards
• Development Processes
• Vision for the NVD

Ultimately, we want to know how we can modernize the NVD to better support cybersecurity outcomes while maintaining trust, transparency, accuracy, and broad accessibility.

Your RFI responses will help inform our future strategic planning efforts, new tool development, technical architecture decisions, standards and best practices development, and data governance approaches.

How to Submit Feedback

Stakeholders are encouraged to submit written comments identifying technical priorities, innovative frameworks, and practical recommendations by October 13, 2026 at 11:59 PM ET. Comments must be submitted via the Federal e-Rulemaking Portal (details below).