IST Urges NIST to Shift CVE Record Quality Duty to Software Publishers

A response to NIST's August request for information

In August, the National Institute of Standards and Technology (NIST) published a Request for Information on Modernizing the National Vulnerability Database in the Age of Artificial Intelligence. IST published its response on October 19, 2026. The authors are Nick Leiserson, Bob Lord and Lauren Zabierek, who draw on their earlier recommendations to policymakers.

According to the authors, AI-driven threats are outpacing traditional vulnerability management strategies. Their proposal would move away from what they call an unsustainable, government-subsidized cleanup of CVE records. Instead, software publishers would be incentivized to submit complete, accurate and timely records, and "enrichment" would add value rather than simply filling in core data fields.

Accountability, not capacity, is the problem

The response states that the Common Vulnerabilities and Exposures (CVE) ecosystem has outgrown the third-party enrichment role the National Vulnerability Database (NVD) was built to play. In the authors' view, the central problem is not processing capacity, and AI-enabled automation will not solve it. The issue is the absence of accountability for record quality at the point records are created.

The authors cite a review of fiscal years 2024 and 2025 by the Cybersecurity and Infrastructure Security Agency (CISA). According to that review, about 40 percent of entries in the Known Exploited Vulnerabilities Catalog mapped to weaknesses the industry has tracked for years, and 31 percent of breaches now begin with vulnerability exploitation. The authors say these defects persist because software manufacturers face no meaningful liability for shipping them.

The same gap applies to records. CVE Numbering Authorities (CNAs), now more than 550 and including most major manufacturers, are not required to publish complete, accurate and timely records, and face no consequence when they do not. The authors argue that NVD's enrichment repairs records after the fact, which masks the failure and weakens the incentive to fix it upstream. AI-accelerated discovery raises record volume and makes the repair model less sustainable, they say.

Four proposed changes

The authors present the changes as substitutions for current NVD activity, not additions to it.

• Sunset enrichment: NIST should end NVD's record-level enrichment function and, working with Congress, transfer the enrichment budget to CISA.
• Set CAT standards: NIST should define explicit standards (complete, accurate, timely) for what a CVE record must contain when a CNA creates it, and formalize a provenanced attribute data model for severity and exploitability claims.
• Measure and publish: CISA should run per-CNA measurement against those standards and publish the results, so record quality becomes visible to manufacturers, operators and buyers. NIST and CISA should also refocus the Common Weakness Enumeration (CWE) taxonomy so the same measurement shows which manufacturers are eliminating recurring classes of defect.
• Retire central CPE upkeep: NIST should end centralized Common Platform Enumeration (CPE) maintenance and transfer product and supplier identification to first-party CNAs.

The authors explicitly do not recommend adding new capabilities to NVD, AI-enabled or otherwise.

Expectations for AI code generation

Beyond the NVD, the response urges NIST to set secure-by-design expectations for AI code generation in its secure development guidance, most directly Special Publication (SP) 800-218A. The authors say AI corporations should test their models against known-unsafe coding patterns before release, publish defect rates in generated code, and tune their models to refuse known-dangerous patterns where possible.

What it means

The response is a policy recommendation to NIST, not a decision, and the source does not say how the agency will act. If adopted, the changes would shift responsibility for record quality to CNAs, which include most major manufacturers, and would give manufacturers, operators and buyers published, per-CNA data on that quality. The proposals would also move enrichment funding from NIST to CISA and put AI model developers under explicit expectations for the security of the code their systems generate.