The U.S. National Institute of Standards and Technology (NIST) has initiated a public consultation to modernize its National Vulnerability Database (NVD), aiming to integrate artificial intelligence (AI) and automation workflows. This effort, announced in a Request for Information (RFI) published in the Federal Register on August 12, seeks to adapt the NVD to a cybersecurity landscape increasingly influenced by AI and the demand for machine-consumable security data.
NIST is soliciting "forward-looking perspectives, practical recommendations, and innovative models" to enhance the NVD's scalability, automation, interoperability, transparency, and overall utility. The agency acknowledges that traditional vulnerability management approaches, which rely on periodic scanning, static prioritization, and manual remediation, are becoming insufficient given the rapid pace of technological change, the proliferation of AI-enabled tools, and the growing volume of vulnerabilities.
Currently, the NVD automatically ingests Common Vulnerabilities and Exposures (CVE) records within approximately an hour. Following this, human analysts enrich these records by adding critical information such as severity scores and details about affected product versions. These enriched records are then made accessible via the NVD website and various automated tools.
The RFI highlights both the opportunities and risks presented by AI in vulnerability management. While AI offers potential for modernizing the process, NIST also recognizes the threat of AI-assisted vulnerability discovery and exploitation. The goal is to evolve the NVD into a system that is "continuous, contextual, and automated," enabling it to effectively respond to emerging threats and organizational priorities.
The RFI includes 30 specific questions designed to gather stakeholder input on necessary changes to the NVD and how AI tools and automation workflows should be integrated. Stakeholders have until October 13 to submit their responses.
Industry experts recognize the potential of AI in vulnerability discovery, particularly for analyzing source code to identify obscure vulnerabilities that human researchers might miss. However, there is also caution regarding the use of AI for remediation, especially in critical or production systems. While AI-driven remediation might be suitable for test environments, the consensus emphasizes the continued necessity of human oversight in production systems.
