Topics:
A white paper published in September by the Cybersecurity & Infrastructure Security Agency (CISA) aims to inject new quality, transparency, and participation dimensions into the Common Vulnerabilities and Exposures (CVE) program. While all four pillars of what CISA is calling its “CVE Quality Era” are fair and necessary, are they simply trying to pump air into a punctured tire?
With artificial intelligence (AI) having done more to disrupt vulnerability and exposure management in the past 10 months than anything else has in arguably the last decade, CVEs’ relevance is in question. Frontier models are uncovering vulnerabilities by the thousands every month, turning monthly patch cycles into a guessing game of how high the number of published Windows vulnerabilities will be for a given Patch Tuesday.
This doesn’t even take into account the vulnerabilities that aren’t even assigned a CVE, those currently under coordinated disclosures, or those that are included in silent updates on a regular cadence. What the overwhelming volume of security updates has done instead, is twofold: one, it’s further exposed the quality issue of the data included in advisories, and two, more importantly, it’s rearranged the priorities around security programs for the better.
No security organization can regression test and apply 1,500 Windows updates in a single patch cycle, never mind that it’s happening month after month at a rapidly escalating pace. Instead, successful security teams will have to understand assets that are essential to the business, document how those assets communicate internally and externally to the public internet, integrators, partners, and vendors, and prioritize remediation according to their impact on the business as a whole.
This article will examine:
CVE context needed to support AI-powered cybersecurity
The need for context in remediating business-critical assets
How CVE overhaul is part of a changing security paradigm
Where once the CVE was the essential tool in vulnerability assessments and remediation processes, now they’re just a reference identifier. While risk scores are a key selling point of CVEs, they’re not a real measure of risk from organization to organization. Criticality scores don’t inform decision makers about an asset’s exposure, the availability of known, public exploits, whether it’s being actively targeted, or how badly a compromised asset would impact the business.
Another risk that CISOs must contend with is that this drastic surge of CVEs may obscure a very real trend: a relatively small percentage of disclosed CVEs are actually publicly exploited. This is a further argument that raw CVEs numbers are no indicator of actual operational risk without additional context.
Let’s look at the recent cyberattacks impacting supermarkets across Europe. There we saw hundreds of stores affected as threat actors compromised popular refrigeration controllers, gained access to these systems, manipulated temperature controls, and caused tons of food to spoil and significant financial losses to these market chains. More seriously, it impacted food safety and security in the region, essentially because an internet-facing controller put these assets at risk. On paper, isolated IoT/OT configuration flaws or minor firmware weaknesses may appear to carry low traditional CVE severity. However, when tied directly to operational infrastructure, a single entry point can produce catastrophic physical and business disruption.
The implication is clear: CISOs need to move beyond counting vulnerabilities and toward understanding which weaknesses matter, why they matter and how quickly they must be addressed.
CVEs are not as essential as they once were, clearly. The world has matured, as has technology. It is part of the resources available to security teams, but it must complement asset visibility and asset management data, and be a source that informs exposure management, network segmentation, and other controls that are critical to a security program.
The supermarket cyberattacks reinforce that CISOs must act on this new paradigm. CVE records without contextual clues such as internet exposure, exploit availability, and business impact are not helpful. AI tools can deliver much of this contextual information, correlating all of these signals and more at machine speed to bring security teams a much more accurate and actionable picture of risk.
Furthermore, remediation of security issues in business-critical assets must be thorough—and happen quickly. Hackers are not just exploiting vulnerabilities; Team82 research earlier this year demonstrated that internet-facing assets that are protected by weak passwords or are poorly configured are child’s play for internet-scanning tools that easily enumerate these vulnerable assets. An attack at scale can therefore happen quickly.
CISA’s CVE Quality Era should be applauded for its recognition that the community needs reliable, accurate data to secure critical infrastructure. CISA is calling upon better, consistent, machine-readable advisory content from vendors and researchers alike. It’s also reaching out to the greater software development community for participation to improve the quality and volume of contextual information. Finally, it calls for improvements not only to governance of the CVE program, but also improvement to the technology infrastructure supporting it.
CVE identifiers will remain relevant because security teams, vendors and technology providers need a common language for vulnerability identification. What must change is the assumption that receiving a CVE and following a conventional patching process are sufficient to manage risk.
In the frontier AI era, the advantage will belong to organizations that combine trusted vulnerability data with contextual intelligence, continuous exposure assessment and faster remediation. The Quality Era can help establish that foundation. The responsibility for turning it into resilience still rests with security leaders.
U.S. Navy Adm. (Ret.) Michael Rogers served as the 17th Director of the National Security Agency and the 2nd Commander of U.S. Cyber Command. Adm. Rogers presided over the activation of the Pentagon's Cyber Mission Forces and the elevation of U.S. Cyber Command to unified combatant command status. He is currently the chairman of Claroty’s Board of Advisors.
