cyber.hendryadrian.com
Security News · wiz.io

NIST Changes NVD CVE Prioritization as Vulnerability Volume Surges

· Original article ↗

Summary

NIST is prioritizing NVD enrichment for vulnerabilities posing clearer risks, including those in CISA’s KEV catalog and critical software. The article argues teams should prioritize vulnerabilities by environmental context and exposure, not severity scores alone.

Key points

  • NIST said CVE submissions rose 263% between 2020 and 2025, prompting a new NVD prioritization model.
  • NVD will prioritize enrichment for vulnerabilities with clearer risks to the federal government and broader cybersecurity ecosystem, including KEV-listed vulnerabilities and those in critical software.
  • The article says vulnerability teams should supplement static severity scores with environment-specific context when prioritizing remediation.
  • Relevant context includes network exposure, identity permissions, misconfigurations, reachability, and sensitive data.
  • The article warns that AI-driven vulnerability discovery and a shorter gap between patch availability and exploitation could further strain count-based workflows.
  • Wiz describes its platform as correlating vulnerability and environment data to prioritize exposures and support remediation.

Article Details

Event Type
NIST update to NVD CVE enrichment and prioritization criteria
Impact
NVD will prioritize enriching vulnerabilities assessed as presenting clearer risk to the federal government and broader cybersecurity ecosystem, including vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog and critical software. The article says this may reduce expectations of comprehensive enrichment and argues that vulnerability teams should prioritize risk using environmental context rather than relying on static severity scores.

Vendors

AnthropicThe recent announcement of Anthropic's new Claude Mythos model makes it clear that we are entering an era where AI can autonomously discover zero-days and rapidly develop exploits. In the short term, this means teamsWizHow Wiz supports the shift to risk-based prioritization

Products

Claude MythosThe recent announcement of Anthropic's new Claude Mythos model makes it clear that we are entering an era where AI can autonomously discover zero-days and rapidly develop exploits. In the short term, this means teamsWiz ASMValidate exploitability with Wiz ASM & the Red Agent: Wiz ASM and the AI-powered Red Agent continuously discover and validate exploitable risks from the attacker’s perspective to help you proactively remove exploitableWiz Exposure ManagementWiz Exposure Management empowers teams to move away from managing CVE counts to prioritizing true exposures by enabling you to:Wiz platformThe Wiz platform was built from day 1 to solve this exact problem using context: moving beyond static CVE counts toward context-based risk prioritization. We believe security should be horizontal, unifying security dataWiz Security GraphPrioritize with context on the Wiz Security Graph: The Wiz Security Graph correlates vulnerabilities with context such as network exposure, identities, misconfigurations, data sensitivity, and more to identify the true

Related Articles