Introduction
NIST has issued a Request for Information (RFI) to gather input on modernizing the National Vulnerability Database (NVD) through AI integration. This move signals a shift from traditional vulnerability management to a more dynamic, AI-driven approach. The agency is developing V-etalon, an AI tool to enhance vulnerability information, and updating the Common Platform Enumeration specifications. Comments are due by October 13, 2026.
This isn't just another standards update. It's a recognition that the old model of periodic patching and manual analysis can't keep up with today's threat landscape.
Key Developments
June 2024: NIST held a workshop to update CPE specifications, focusing on hardware vulnerabilities and lessons from operational use.
RFI Release: The RFI outlines five feedback areas: vulnerability management processes, information dissemination, risk assessment and prioritization, remediation workflows, and data standards.
V-etalon Development: NIST is working on an AI tool to enrich vulnerability data, with plans to release it on GitHub for community input.
October 13, 2026: Deadline for stakeholder comments via the Federal e-Rulemaking Portal.
Identifying Control Gaps
This isn't a typical incident but highlights a systemic gap: existing frameworks can't operate at machine speed.
Risk Assessment Velocity: According to NIST SP 800-53 Rev. 5 control RA-5, organizations must scan for vulnerabilities and address threats. When disclosure volume outpaces your team's capacity, you're not managing risk, you're overwhelmed.
Contextual Analysis: ISO/IEC 27001:2022 Annex A 8.8 requires timely vulnerability information evaluation. Manual cross-referencing of CVEs against asset inventories and threat feeds is unsustainable without automation.
Continuous Monitoring: The NIST Cybersecurity Framework (CSF) 2.0 Detect function calls for continuous monitoring. If you're on monthly scan cycles, you're not meeting this standard.
The NVD hasn't failed, but reliance on manual processes around it has.
Standards and Requirements
NIST SP 800-53 Rev. 5 RA-3 requires risk assessments at defined frequencies and when significant changes occur. AI changes what "significant change" means. If AI can correlate new CVEs with active exploitation quickly, quarterly reviews are insufficient.
ISO/IEC 27001:2022 Annex A 5.7 mandates timely threat intelligence. As NIST moves toward AI-driven analysis, manual workflows become a compliance gap.
NIST Cybersecurity Framework (CSF) 2.0 2.0 Identify.RA-07 assumes you can identify vulnerabilities at a pace that supports informed decisions. If you can't keep up with AI tools, your risk register is outdated.
NIST Risk Management Framework Step 4 (Assess) requires ongoing assessment of control effectiveness. If V-etalon enriches data faster than your team, your assessment cycle is misaligned.
Action Items for Your Team
Map Your Workflow: Document how long it takes to move from CVE publication to risk-informed decisions. If it's weeks, identify steps like asset correlation and exploitability analysis that could be automated.
Engage in the RFI Process: Provide input on areas like data structures and update cadences that create friction in your program. Be specific about missing fields and manual enrichment that could be standardized.
Prepare for Continuous Management: Review controls assuming periodic activities. Align frequencies with AI-enabled threat discovery. Plan for a shift from periodic to continuous management.
Test AI Tools: When V-etalon is released, evaluate it against critical assets. Compare its output with your manual process to identify gaps and value-add.
Update Vendor Assessments: If you use third-party platforms, ask how they'll integrate NIST's modernized data. Ensure their roadmap aligns with NIST's direction.
Revise Control Testing: If audits test controls by sampling monthly reports, redefine evidence for continuous monitoring. Show real-time risk contextualization.
The NVD modernization isn't just a NIST project. It's a shift from compliance checklists to continuous, automated risk management. Your controls need to adapt.
