NIST Asks: How AI Can Improve Vulnerability Database?

The U.S. National Institute of Standards and Technology is asking how artificial intelligence can improve the National Vulnerability Database. The agency runs this database, which is a key repository for vulnerability intelligence. NIST is seeking industry advice on automating different stages of vulnerability management. This includes identifying, validating, disclosing, prioritizing, and remediating software and system vulnerabilities. The agency notes that new reports are coming into the database faster than it can respond. The public comment period for this request will last 60 days. NIST aims to create a future-ready vulnerability management ecosystem that is continuous, contextual, and automated. This initiative comes as traditional vulnerability management approaches are proving inadequate. What's interesting is that NIST previously enriched all vulnerability entries with details like severity scores. However, a surge in submissions now means they only enrich entries meeting specific criteria, such as actively exploited vulnerabilities or those affecting federal government software. The agency wants to understand which tasks are suitable for AI automation and which still require human review. They are also looking into novel governance and risk management considerations for AI use. This effort matters because AI could transform how we manage cybersecurity risks.