NIST Seeks Public Input on AI-Ready NVD Modernization

The US National Institute for Standards and Technology (NIST) is looking to modernize its National Vulnerability Database (NVD) to address challenges posed by AI and incorporate more automation and AI workflows.

In a request for information (RFI) published on August 12 in the Federal Register, NIST encouraged stakeholder input on opportunities, challenges and priorities for modernizing the NVD in “an evolving cybersecurity landscape increasingly shaped by AI and machine-consumable security data.”

The Institute is particularly interested in receiving “forward-looking perspectives, practical recommendations and innovative models” that will improve the NVD’s scalability, automation, interoperability, transparency and utility.

Today, the NVD automatically ingests common vulnerabilities and exposures (CVE) records within about an hour, after which analysts add information such as severity scores and affected product versions. These enriched records are available through the NVD website and automated tools.

However, NIST noted that traditional methods based on “periodic scanning, static prioritization, and manual remediation” are becoming inadequate.

The RFI highlighted how vulnerability management is changing rapidly due to AI-enabled tools, faster technology cycles, growing vulnerability volumes and increased demand for automation and near-real-time data.

The Institute presented AI as an opportunity to modernize vulnerability management, while recognising risks such as AI-assisted vulnerability discovery and exploitation.

It seeks community input to create a system that is “continuous, contextual, and automated” and capable of responding effectively to emerging threats and organisational priorities.

The RFI includes a list of 30 questions inviting stakeholders to assess what the NVD should change and how it should integrate AI tools and automation workflows.

Tyler Reguly, associate director of security R&D at Fortra, said that AI can be beneficial for vulnerability discovery, particularly when analyzing source code, as it can identify “all sorts of obscure vulnerabilities” that human researchers might overlook.

However, he warned organizations against relying too heavily on AI for remediation, especially in critical or production systems. Reguly said, “I would not trust the remediation of vulnerabilities in critical systems to AI just yet,” stressing that “human-in-the-loop is still so critical.”

He added that AI remediation may be suitable in test environments and laboratories, but “In production systems… not yet.”

Stakeholders have until October 13 to submit their input.