Cybersecurity Policy Report, NIST Eyes AI to Solve Cyber Vulnerability Database Backlog, (Aug 12, 2026)
Faced with a flood of new cyber vulnerabilities to catalog in its National Vulnerability Database (NVD), the National Institute of Standards and Technology today called for stakeholder input on how to improve the NVD.
“NIST seeks stakeholder input on opportunities, challenges, and priorities for modernizing the NVD in an evolving cybersecurity landscape increasingly shaped by artificial intelligence (AI) and machine-consumable security data,” NIST said in a request for information (RFI) published in today’s Federal Register (91 Fed Reg 52042).
“Today’s vulnerability management ecosystem is rapidly evolving and is characterized by AI-enabled cyber tools and accelerated technology delivery cycles. Malicious actors may seek to leverage AI systems to discover and exploit vulnerabilities at scale and to support post-exploitation activities,” NIST said.
“The inadequacies of traditional vulnerability management approaches, which center on periodic scanning, static prioritization, and manual remediation, are increasingly apparent,” it added.
NIST has been struggling recently to keep the NVD up to date as cyber-capable AI models have increased the number of vulnerabilities submitted for inclusion and led to a backlog in NIST’s cataloging process. In April, it announced that it would conserve its resources by listing fewer details about vulnerabilities that seem less consequential (CPR, April 16).
“The advancement of AI presents an opportunity to transform the vulnerability management ecosystem. This requires input from across the community to ensure this ecosystem is effective, scalable, and resilient in the face of emerging threats,” NIST said.
“NIST is using this RFI to give the broader community an opportunity to identify forward-looking perspectives, practical recommendations, and innovative models to help shape the NVD moving forward. Responses are intended to inform future strategic planning, technical architecture decisions, standards and best practices development, data governance approaches, and community collaborations related to the continued evolution of the NVD,” it said.
The RFI tees up several issues for stakeholders to address, including how to address “bottlenecks” in the vulnerability management process and whether “AI-enabled automation” might help. Comments are due Oct. 13 and should be filed in docket NIST-2026-0100 in regulations.gov.
News: FederalLegislation DataSecurity AINews