The National Institute of Standards and Technology (NIST) is looking for stakeholder input on how to modernize its National Vulnerability Database (NVD) “in an evolving cybersecurity landscape increasingly shaped by artificial intelligence (AI).”
In a request for information (RFI) scheduled for publication in the Federal Register on Aug. 12, NIST said it wants to improve the NVD’s scalability, automation, interoperability, transparency, and utility. The agency is seeking feedback across seven areas, ranging from AI-enabled vulnerability management to vulnerability data standards.
The NVD provides the U.S. government repository of standards-based vulnerability management data and is a foundational resource for vulnerability management, software security, compliance automation, and cybersecurity risk analysis across the public and private sectors.
The RFI states, “The advancement of AI presents an opportunity to transform the vulnerability management ecosystem. This requires input from across the community to ensure this ecosystem is effective, scalable, and resilient in the face of emerging threats.”
Currently, NIST said the NVD ingests Common Vulnerabilities and Exposures (CVE) within one hour of publication using automation. NVD analysts then enhance the CVE records with additional information and analysis, which users and security tools can access through the NVD’s web interface or through automated mechanisms.
NIST is asking stakeholders where AI-enabled automation could address bottlenecks in the vulnerability management lifecycle and which activities should continue to require human review.
The agency also wants feedback on using AI to improve contextual risk prioritization while maintaining transparency and auditability. Other RFI questions address how the NVD could better integrate with vulnerability disclosure programs, vendor advisories, threat intelligence providers, asset management platforms, security tools, and remediation workflows.
NIST is also exploring AI’s potential role in automated remediation, including what standards, procedures, and safeguards could prevent erroneous AI-generated fixes.
Looking ahead, the agency is asking what capabilities the NVD should add over the next five years and what metrics should measure modernization efforts.
“Responses are intended to inform future strategic planning, technical architecture decisions, standards and best practices development, data governance approaches, and community collaborations related to the continued evolution of the NVD,” the RFI states.
Comments are due within 60 days of the RFI publication date.