Wow. CVE database is in serious trouble, tomorrow.
The cyber industry as a whole is in trouble also really, it’s the elephant in the room - the collapse of the White House’s support for cybersecurity is obvious and pronounced due to widespread cutbacks.
My take on the CVE contract issue for businesses: don’t overreact, wait and see what impacts are.
The NVD backlog was already pretty crazy.. the US gov has gotta put real funding into this area if it wants to retain control of cyber standards.
To widen it out - CVE is the globally recognised system orgs use for vulnerability management.
Every vulnerability management product uses CVEs. Vulnerability management is a core part of cybersecurity - often, the most important part.
Additionally, CVE is written into several US government standards that orgs have to follow.
So the US Government not funding it is a major and historic own goal.
Kevin Beaumont
Lauren Weinstein